Web & certificates

What is Security headers? HTTP security headers explained

Security headers are HTTP response headers with which a website instructs the browser to block attacks such as cross-site scripting, clickjacking and data leakage.

How Security headers works

Content-Security-Policy (CSP) defines from which sources scripts, styles and images may be loaded – the most effective protection against injected code. X-Content-Type-Options: nosniff stops the browser from guessing file types.

Against clickjacking, i.e. invisibly embedding your page in other sites, X-Frame-Options or the CSP directive frame-ancestors help. Referrer-Policy limits which addresses are passed on to other sites, and Permissions-Policy switches off browser features such as camera or location.

Headers such as Server or X-Powered-By should not reveal version numbers, because attackers use them to look for known vulnerabilities. The Domain Trust Check examines the headers of the actual landing page after all redirects.

Example

Content-Security-Policy: default-src 'self'; frame-ancestors 'self'
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

A CSP must fit the website: external scripts, fonts or analytics services have to be allowed explicitly.

Common mistakes

A CSP with 'unsafe-inline' and 'unsafe-eval' that barely protects anything.
Headers only on the home page, but not on subpages or error pages.
X-Powered-By: PHP/8.x or Server: Apache/2.4.x with a version number.

How the Domain Trust Check rates Security headers

Criterion “Security headers” (weight 2 of 5): HTTP security headers of the actual landing page: Content-Security-Policy, X-Content-Type-Options, clickjacking protection, Referrer-Policy, Permissions-Policy and no version disclosure.

Standard: W3C Content Security Policy Level 3, RFC 7034 (X-Frame-Options)