#security-headers

Security Headers

We scanned 5 popular security scanners — and every one still leaked something

We scanned 5 popular security scanners with our own engine. None had a critical flaw — but every one leaked something Medium. Here is what, and why it matters.

Security Headers

A complete, copy-paste security header set (and what each one does)

A practical reference: the security headers worth setting, sane values for each, and exactly what every line buys you. Copy it, adjust the CSP, ship it.

Security Headers

HSTS explained: why HTTPS alone is not enough

You have HTTPS — but the first plain-HTTP request is still a weak point. HSTS closes it by telling the browser to never speak HTTP to your site again.

Security Headers

Content-Security-Policy for people who do not write CSPs

CSP is the strongest defense against cross-site scripting — and the most misunderstood header. Here is what it actually does, minus the jargon.

Security Headers

What is a security header, and which ones actually matter?

Security headers are short instructions your server sends with every page, telling the browser to switch on protections. Most sites are missing several. Here is the shortlist.