Security
Website security headers: what the common headers do
Security headers give browsers instructions about how to handle content, transport, embedding, referrers, and selected platform features. They can reduce certain classes of risk, but a copied header bundle can also break a real application.
Content Security Policy is powerful and application-specific
CSP can limit where scripts, styles, frames, images, and connections are loaded from. Build it from the resources the application actually needs, use reporting during rollout, and avoid weakening it with broad wildcards simply to make console errors disappear.
HSTS protects the transport decision after HTTPS is stable
It tells supporting browsers to prefer HTTPS for a remembered period. Certificate renewal and subdomain planning should be mature before long max-age or includeSubDomains settings are used.
Frame, referrer, and permissions controls solve different problems
Frame restrictions can reduce unwanted embedding, Referrer-Policy controls information sent with navigation, and Permissions-Policy limits selected browser features. Choose values that match application behaviour and third-party integrations.
Headers complement application security
They do not replace patching, secure authentication, authorization, input handling, dependency management, server hardening, backups, or incident response. Treat them as one layer in a broader security baseline.