Web Security Headers Cheat Sheet

Quick reference guide for Web Security Headers: CSP, HSTS, X-Frame-Options, CORS, and security policy rules.

Security Tools
security-headers
csp
hsts

HTTP security headers tell browsers how to behave when handling your site's content to protect against XSS, clickjacking, and MIME sniffing.

Essential Security Headers Summary

Table
Header NameRecommended ValueProtection Goal
Content-Security-Policydefault-src 'self'; script-src 'self'Prevent XSS and unauthorized data injection
Strict-Transport-Securitymax-age=31536000; includeSubDomainsForce HTTPS connection (HSTS)
X-Frame-OptionsDENY or SAMEORIGINProtect against Clickjacking attacks in <iframe>
X-Content-Type-OptionsnosniffPrevent MIME type sniffing by browsers
Referrer-Policystrict-origin-when-cross-originControl URL referrer information leakage
Permissions-Policycamera=(), microphone=(), geolocation=()Restrict browser hardware API capabilities

Content Security Policy (CSP) Directives

http
Content-Security-Policy:
  default-src 'self';
  script-src 'self' https://trustedscripts.example.com;
  style-src 'self' 'unsafe-inline';
  img-src 'self' data: https:;
  font-src 'self' https://fonts.gstatic.com;
  connect-src 'self' https://api.example.com;
  frame-ancestors 'none';
  base-uri 'self';
  form-action 'self';

CORS Headers Reference

Table
CORS HeaderDirectionDescription
Access-Control-Allow-OriginResponseWhitelisted origin (https://example.com) or *
Access-Control-Allow-MethodsResponseAllowed HTTP methods (GET, POST, OPTIONS, PUT)
Access-Control-Allow-HeadersResponseAllowed request headers (Content-Type, Authorization)
Access-Control-Allow-CredentialsResponseSet to true to allow cookies in cross-origin requests
Access-Control-Max-AgeResponsePreflight OPTIONS cache duration in seconds (86400)

Common Pitfalls & Tips

[!WARNING] Setting Access-Control-Allow-Origin: * while also setting Access-Control-Allow-Credentials: true is forbidden by browser CORS security specifications!

[!TIP] Use Content-Security-Policy-Report-Only during initial deployment to test CSP policies without breaking site functionality.

Related tools

HTTP Security Header CheckerCSP Policy Builder