HTTP Headers Guide

What Are HTTP Headers?

HTTP headers are metadata included in HTTP requests and responses between clients and servers. Request headers carry information from the client (browser type, accepted content types, etc.), while response headers carry server instructions (caching policy, security policy, content type, etc.).

Headers follow a simple Name: Value format. A significant portion of web security is achieved through correct response header configuration. Missing security headers like HSTS, CSP, and X-Frame-Options can leave your site vulnerable to clickjacking, XSS, and man-in-the-middle attacks.

Essential Security Headers

HSTS (Strict-Transport-Security)

HSTS instructs the browser to connect to your site over HTTPS only. Once set, the browser automatically upgrades HTTP → HTTPS for the duration of max-age, preventing SSL stripping attacks.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

CSP (Content-Security-Policy)

CSP restricts the origins from which resources can be loaded. It's the most effective header against XSS attacks.

Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-{random}'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:

When adding CSP to an existing site, start with Content-Security-Policy-Report-Only to log violations without blocking, then tighten the policy incrementally.

X-Frame-Options

X-Frame-Options: SAMEORIGIN

Prevents clickjacking by controlling whether the page can be embedded in an <iframe>. DENY blocks all embedding; SAMEORIGIN allows same-domain only. CSP's frame-ancestors directive provides finer control but set both for backward compatibility.

X-Content-Type-Options

X-Content-Type-Options: nosniff

Prevents browsers from MIME-sniffing responses — guessing content type from file contents rather than the declared Content-Type. This blocks scripts disguised as images.

Referrer-Policy

Referrer-Policy: strict-origin-when-cross-origin

Controls how much referrer information is sent when navigating to other sites. This setting sends the full URL for same-origin requests, only the domain for cross-origin, and nothing for HTTP → HTTPS downgrades.

CORS (Cross-Origin Resource Sharing)

CORS allows web pages to access resources from a different origin (domain, protocol, or port) by selectively relaxing the browser's same-origin policy.

# Allow specific origin (recommended)
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: Content-Type, Authorization

# Allow credentials (cannot use * with credentials)
Access-Control-Allow-Credentials: true

The most common CORS errors stem from a missing Access-Control-Allow-Origin header or mixing a wildcard (*) with credentials: true. When credentials are included, you must specify an explicit origin — wildcards are not allowed.

Cache Header Strategy

# Static assets (JS, CSS, images) — long-term cache
Cache-Control: public, max-age=31536000, immutable

# HTML — always revalidate
Cache-Control: no-cache

# API responses — no caching
Cache-Control: no-store, no-cache, must-revalidate

Including a content hash in filenames (e.g., main.a3f2b1.js) makes it safe to use immutable with a one-year max-age. Set HTML to no-cache so browsers always receive the latest version.

Nginx Configuration Example

server {
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    location ~* \.(js|css|png|jpg|gif|ico|woff2)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
    }
}

FAQ

Try the Tool

To analyze your HTTP response headers and get a security score, use the HTTP Header Analyzer. Copy headers from your browser's DevTools and paste them in for instant analysis.