HTTP Security Headers: CSP, HSTS & X-Frame-Options Explained

HTTP security headers are directives your web server sends with every response, instructing the browser how to behave. A missing or misconfigured header can expose your app to clickjacking, cross-site scripting, MIME sniffing, and man-in-the-middle attacks — often with no user-visible sign that anything is wrong until an attack succeeds.

Content-Security-Policy (CSP)

CSP is the most powerful security header. It tells the browser which origins are allowed to load scripts, styles, images, and other resources. A strict policy like default-src 'self' blocks all inline scripts and external resources by default, making XSS attacks significantly harder to execute even when an injection vulnerability exists.

Strict-Transport-Security (HSTS)

HSTS forces browsers to use HTTPS for all future requests to your domain, even if the user types http://. Set it with a long max-age: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload. The preload flag submits your domain to browser preload lists, protecting even first-time visitors.

X-Frame-Options

This header prevents your page from being embedded in an iframe on another domain, blocking clickjacking attacks. Use X-Frame-Options: DENY to block all framing, or SAMEORIGIN to allow only same-origin frames. For modern browsers, the CSP frame-ancestors directive is more flexible and preferred.

X-Content-Type-Options

Setting X-Content-Type-Options: nosniff prevents browsers from guessing a resource's MIME type. Without it, a browser might execute a text file as JavaScript if it looks like script. Always pair this with correct Content-Type headers on your responses.

Quick Reference