HTTP security headers

A reference for every security header that matters in 2026: what it does, the value to use, the mistakes that make it useless, and copy-paste config for nginx, Apache, Laravel, Express and Cloudflare. Each page has a live check for your own site.

Check all your headers at once

Get an A-F grade for your site's security headers with a fix for each one.

Analyzing security headers...

Fetching and evaluating 7 HTTP security headers.

Essential for every site

Content-Security-Policy

Tells the browser which scripts, styles, frames and connections a page may load. The strongest defence you can add against XSS.

default-src 'self'; script-src 'self' 'nonce-{RANDOM}'; style-src 'self'; img-src 'self' data:; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self'

Strict-Transport-Security

Tells the browser to use HTTPS for your domain for a set time, so a network attacker cannot downgrade visitors to plain HTTP.

max-age=31536000; includeSubDomains

X-Frame-Options

Controls whether other sites may show your page inside a frame, which is how clickjacking attacks work.

DENY

X-Content-Type-Options

Stops the browser guessing a response's type from its contents, so an uploaded text file cannot be run as a script.

nosniff

Referrer-Policy

Controls how much of the current URL the browser sends in the Referer header when users follow links or load resources from other sites.

strict-origin-when-cross-origin

Recommended hardening

Permissions-Policy

Turns browser features such as camera, microphone, geolocation and payment off for your page and anything it embeds.

camera=(), microphone=(), geolocation=(), payment=(), usb=()

Cross-Origin-Opener-Policy

Puts your page in its own browsing context group, so cross-origin windows you open, or that open you, lose their reference to it.

same-origin-allow-popups

Cross-Origin-Resource-Policy

Tells the browser which sites may embed this response with <img>, <script> and similar no-CORS requests.

same-origin

Situational

Cross-Origin-Embedder-Policy

Only lets your page load cross-origin resources that explicitly allow it. Needed, with COOP, for cross-origin isolation.

credentialless

Access-Control-Allow-Origin

Tells the browser which other origins may read this response from JavaScript. Too strict and your front end breaks; too loose and any site can read your users' data.

https://app.example.com

Deprecated

X-XSS-Protection

Controlled the XSS auditor that old browsers ran. No current browser has that auditor, so the header does nothing useful today.

Cookies are headers too

Session cookies need the Secure, HttpOnly and SameSite attributes on their Set-Cookie header. Check your cookies.

FAQ

What are HTTP security headers?

Response headers that tell the browser how to handle your page: which scripts may run (Content-Security-Policy), whether to force HTTPS (HSTS), whether the page may be framed (X-Frame-Options), and more. They block whole classes of attacks with a few lines of server config.

Which security headers should every site have?

Content-Security-Policy, Strict-Transport-Security, X-Frame-Options (or CSP frame-ancestors), X-Content-Type-Options: nosniff and Referrer-Policy. Permissions-Policy and Cross-Origin-Opener-Policy are cheap extra hardening.

How do I check my security headers?

Use the free security headers check on this page. It fetches your URL once, grades each header and shows the fix. Each header page below also has a single-header check.

Is X-XSS-Protection still a security header I need?

No. It is deprecated and no current browser uses it. Send 0 or omit it, and use Content-Security-Policy.

Setting them in Laravel? See how to fix missing security headers in Laravel and the types of security headers.