Security Headers
X-Content-Type-Options: the one-line header against MIME sniffing
Some security work is genuinely a one-liner. This header is one of them: a single value that stops the browser from second-guessing what your files are.
Tag
#security-headers
Security Headers
Clickjacking & X-Frame-Options: stop your site being framed
Clickjacking loads your real site inside an invisible frame so users click things they cannot see. The defense is one header — here is how to set it right.
Security Headers
We scanned 5 popular security scanners — and every one still leaked something
We scanned 5 popular security scanners with our own engine. None had a critical flaw — but every one leaked something Medium. Here is what, and why it matters.
Security Headers
A complete, copy-paste security header set (and what each one does)
A practical reference: the security headers worth setting, sane values for each, and exactly what every line buys you. Copy it, adjust the CSP, ship it.
Security Headers
HSTS explained: why HTTPS alone is not enough
You have HTTPS — but the first plain-HTTP request is still a weak point. HSTS closes it by telling the browser to never speak HTTP to your site again.
Security Headers
Content-Security-Policy for people who do not write CSPs
CSP is the strongest defense against cross-site scripting — and the most misunderstood header. Here is what it actually does, minus the jargon.
Security Headers
What is a security header, and which ones actually matter?
Security headers are short instructions your server sends with every page, telling the browser to switch on protections. Most sites are missing several. Here is the shortlist.