Security Header Guides
What each HTTP security header does, the value to use, and how to add it in Nginx, Apache, and Cloudflare.
Strict-Transport-Security
What the HSTS header does, how to configure max-age, includeSubDomains and preload, and how to add it in Nginx, Apache, and Cloudflare.
X-Content-Type-Options
Why the X-Content-Type-Options: nosniff header matters, what MIME sniffing is, and how to set it in Nginx, Apache, and Cloudflare.
X-Frame-Options
How X-Frame-Options prevents clickjacking, DENY vs SAMEORIGIN, why frame-ancestors supersedes it, and how to set it in Nginx, Apache, and Cloudflare.
X-XSS-Protection
The X-XSS-Protection header is a legacy filter that can introduce vulnerabilities. Learn why modern guidance is to set it to 0 and rely on CSP.
Referrer-Policy
How Referrer-Policy limits the referrer data sent to other sites, the safest values, and how to configure it in Nginx, Apache, and Cloudflare.
Permissions-Policy
How Permissions-Policy (formerly Feature-Policy) restricts camera, microphone, geolocation and more, with ready-to-paste Nginx, Apache, and Cloudflare config.
Cross-Origin-Opener-Policy
What COOP does, how same-origin isolation defends against Spectre-style attacks, and how to set Cross-Origin-Opener-Policy in Nginx, Apache, and Cloudflare.
Setup guides by platform
Check your site's headers
Scan any URL free to see which of these headers you're missing.
Scan Now - Free