HTTP Security Headers Checklist

CSP, HSTS, nosniff, frame protection, referrer policy and permissions policy review. Last updated August 31, 2026.

Security headers turn browser behavior into part of the application security model. MDN explains Content Security Policy as instructions from a site to a browser that restrict what page code may do, especially what resources it may load. See MDN CSP. MDN also documents HSTS and MIME sniffing protection through Strict-Transport-Security and X-Content-Type-Options.

Inspect headers first

curl -I https://example.com/
curl -I https://example.com/app.js
curl -I https://example.com/api/profile

Header checklist

Header	Typical goal	Review warning
`Content-Security-Policy`	Limit scripts, styles, images, frames and connections.	Start in report-only mode for complex apps when possible.
`Strict-Transport-Security`	Tell browsers to use HTTPS for future requests.	Be careful with `includeSubDomains` and preload if subdomains are not ready.
`X-Content-Type-Options`	Prevent MIME sniffing with `nosniff`.	Make sure JS and CSS files have correct content types.
`Referrer-Policy`	Control how much URL context is sent as referrer.	`strict-origin-when-cross-origin` is a practical default for many sites.
`Permissions-Policy`	Limit browser features such as camera, microphone and geolocation.	Do not allow features the page never uses.
`frame-ancestors`	Control who can embed the page.	Prefer CSP `frame-ancestors` over legacy-only framing assumptions.

Static site starter policy

Content-Security-Policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

Nginx example

add_header Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests" always;
add_header Strict-Transport-Security "max-age=31536000" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

Deployment review

Check headers on HTML, JS, CSS, images and API responses separately.
Verify ad, analytics and CDN domains before tightening script-src or connect-src.
Do not preload HSTS until every important subdomain is HTTPS-ready.
Record the expected policy in the changelog or security notes.
Retest after CDN, reverse proxy or hosting changes.

Security headers should be reviewed as production behavior. A policy that blocks required scripts is a reliability bug; a policy that allows everything is barely a policy.