The security headers I put on every website (including this one)

A handful of HTTP response headers block whole classes of attacks: clickjacking, protocol downgrades, content sniffing and many cross-site scripting payloads. They cost nothing and take minutes to add. Here is the set I use, and why.

1. Strict-Transport-Security

HSTS tells browsers to only ever reach your site over HTTPS. After the first visit, a network attacker can no longer downgrade the connection to plain HTTP.

2. Content-Security-Policy

CSP is an allow-list of where scripts, styles, images and frames may load from. A strict policy turns most injected scripts into harmless text. Its frame-ancestors directive also replaces the older X-Frame-Options header against clickjacking.

Tip: start with Content-Security-Policy-Report-Only for a week. The browser reports what would break without blocking anything.

3. The quick wins

• X-Content-Type-Options: nosniff stops browsers from guessing file types.
• Referrer-Policy limits how much of your URLs leaks to other sites.
• Permissions-Policy switches off camera, microphone and location for pages that never need them.

The config for this site

This blog is a static site served by Cloudflare Workers, so the headers live in a single _headers file:

/*
  Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  Content-Security-Policy: default-src 'self'; script-src 'self' https://giscus.app https://static.cloudflareinsights.com; connect-src 'self' https://assets.mailerlite.com https://cloudflareinsights.com; frame-src https://giscus.app; frame-ancestors 'none'; base-uri 'self'; form-action 'self' https://assets.mailerlite.com
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: camera=(), microphone=(), geolocation=()

Then check the result with a free scanner such as Mozilla’s HTTP Observatory, and you’re done.

Written by Marcos Garcia ChillonIndependent cyber-security consultant in Switzerland. More about me