Security reference

Security Headers Reference

Review common website security headers and what they do in a quick browser-based reference built for developers, technical site owners, and security-minded workflows.

Common security headers
Header Main purpose
Content-Security-PolicyControls where scripts, styles, images, and other resources can load from.
X-Content-Type-OptionsHelps stop MIME-type sniffing when set to nosniff.
X-Frame-OptionsHelps reduce clickjacking by limiting framing behavior.
Referrer-PolicyControls how much referrer information browsers send on outbound requests.
Permissions-PolicyRestricts browser features such as microphone, camera, or geolocation.
Strict-Transport-SecurityForces browsers to prefer HTTPS after the first secure visit.
Cross-Origin-Resource-PolicyControls which origins can load certain resources.
Cross-Origin-Opener-PolicyHelps isolate browsing contexts for stronger cross-origin protection.
Cross-Origin-Embedder-PolicyWorks with other cross-origin headers for tighter isolation policies.
What this tool is useful for
  • understanding the role of common security headers during site hardening
  • reviewing header names quickly without digging through external docs
  • supporting checklists for website launches, migrations, and technical audits
Common mistakes

Common mistakes include enabling headers without understanding their impact, assuming every site needs the exact same settings, or skipping testing after adding headers that affect assets, embeds, or browser behavior.

Related workflows

This fits into website hardening, security review, launch QA, hosting setup, browser policy review, and technical workflows where response header quality matters.