Security Blog

Web Security Guides & Tutorials

Learn about Content Security Policy, HTTP security headers, and best practices to protect your web applications.

October 4, 2026HeaderTest Team

Beyond Security Headers: Mapping Your Attack Surface (Open Ports, CVEs, DNS)

An A+ header grade protects your users in the browser, but attackers start one layer lower: exposed servers, forgotten ports and unpatched software. Here's how to see your domain the way they do.

July 18, 2026HeaderTest Team

How to Add a Content Security Policy to a Next.js App

Next.js emits inline hydration scripts, so a naive script-src blocks your own app. Here is the clean nonce + strict-dynamic setup in middleware, plus the styled-jsx and next/image gotchas.

July 18, 2026HeaderTest Team

How to Add Security Headers in Nginx

Nginx sets response headers with add_header. Here is a copy-paste server block for HSTS, X-Frame-Options, nosniff and more — plus the inheritance trap that silently drops your headers inside a location block.

July 18, 2026HeaderTest Team

How to Add Security Headers in Apache

Apache sets headers with mod_headers. Here is a copy-paste config for HSTS, X-Frame-Options, nosniff and more — and why you want Header always set rather than Header set.

July 18, 2026HeaderTest Team

How to Add Security Headers with Cloudflare

Proxied through Cloudflare? Add HSTS, X-Frame-Options, Referrer-Policy and more at the edge with Managed Transforms and Transform Rules — no origin changes required.

July 18, 2026HeaderTest Team

Stopping DOM-Based XSS with Trusted Types and CSP

A strict CSP stops injected script tags, but DOM-based XSS sneaks attacker input into sinks like innerHTML and eval that your own trusted code already runs. Trusted Types, shipped through CSP, makes those sinks refuse raw strings and closes the gap.

May 28, 2026HeaderTest Team

How to Deploy a Content Security Policy Without Breaking Your Site

CSP feels risky because a too-strict policy breaks your site. Report-Only mode lets you test against real production traffic and break nothing. This is the full rollout workflow, from first report to enforced policy.

March 11, 2026HeaderTest Team

How CSP Level 3 Stops XSS — And What to Pair It With

CSP Level 3 replaces fragile allowlists with nonce-based policies and strict-dynamic to stop XSS. Learn how to pair it with Trusted Types, SRI, and sanitization for layered defense.

February 15, 2026HeaderTest Team

HeaderTest Out of Beta: New Scoring and Domain History

HeaderTest is out of beta. Here's what changed: a new three-category scoring system, domain history pages with score trends, and a more accurate analysis engine.

February 8, 2026HeaderTest Team

Next.js + Sanity CMS: CSP Gap and Image Proxy Risk

A lot of Next.js sites using Sanity CMS ship with no CSP at all. Worse, the _next/image endpoint can become an open image proxy for cdn.sanity.io. Here's what's happening and how to lock it down.

January 13, 2026HeaderTest Team

What is Content Security Policy (CSP)? Complete Guide

A practical walkthrough of Content Security Policy — what it actually does, how browsers enforce it, and how to roll one out without breaking your site.

January 12, 2026HeaderTest Team

HTTP Security Headers Explained: Complete Checklist

The security headers that actually matter, what each one does, and copy-paste values to get you started. No fluff, just the headers you need.

January 11, 2026HeaderTest Team

How to Fix unsafe-inline in CSP: Complete Guide

unsafe-inline in your CSP basically turns off XSS protection. Here's how to get rid of it using nonces, hashes, or by refactoring your code.

January 10, 2026HeaderTest Team

Top 10 CSP Mistakes Developers Make (And How to Fix Them)

We scan thousands of CSP headers. These are the mistakes that come up over and over — and they're all fixable.

Test Your Website's Security

Use our free scanner to analyze your Content Security Policy and security headers instantly.

Scan Now - Free