Browser security headers

Beyond HSTS and CSP, browsers honour a handful of other response headers that each switch off one specific class of attack. They are cheap to add, rarely break anything, and each closes a gap that the browser would otherwise leave open by default. None replaces fixing the underlying application, but together they limit the damage when something else goes wrong.

Clickjacking: frame-ancestors

A page that can be embedded in another site's frame can be overlaid with invisible elements, so a visitor thinks they are clicking one thing while actually clicking a button on yours. The modern control is the frame-ancestors directive in your Content-Security-Policy. The older X-Frame-Options header does the same job and is still read by older browsers.

Content-Security-Policy: frame-ancestors 'none'
X-Frame-Options: DENY

Use 'none' unless a specific partner needs to embed you, in which case list their origin. Use 'self' if you embed your own pages.

Content sniffing: X-Content-Type-Options

If a response arrives with a missing or vague content type, browsers will inspect the body and guess. An attacker who can upload a file that looks like script can then get it executed as one. A single header turns the guessing off:

X-Content-Type-Options: nosniff

Referrer-Policy

When a visitor follows a link, the browser tells the destination which page they came from, including the path and query string. If those contain a reset token, an account identifier or a search term, they leak to every third party you link to or load resources from. Browsers now default to a reasonably safe value, but setting it explicitly makes the behaviour the same everywhere.

Referrer-Policy: strict-origin-when-cross-origin

Permissions-Policy

Controls which powerful browser features, such as camera, microphone, geolocation and payment, your page and any embedded frames may use. Declare the ones you do not use as empty, so an injected script or a third-party frame cannot turn them on.

Permissions-Policy: camera=(), microphone=(), geolocation=()

Cross-origin isolation: COOP, CORP and COEP

Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy and Cross-Origin-Embedder-Policy separate your page from other origins' windows and resources. They defend against a family of side-channel attacks and are required to use features like SharedArrayBuffer. They can also break pages that load third-party content, so they are worth adopting deliberately rather than by default. Surface lists them for information and does not score their absence.

Headers to remove

• •X-XSS-Protection: 1 — the old browser filter has been removed from modern browsers, and in the past it introduced vulnerabilities of its own. Send 0 or omit it.
• •Server and X-Powered-By with version numbers — tell attackers exactly which known vulnerabilities to try. Remove the version, or the header.