Security Headers
Last updated
Last updated
testssl.shThe HTTP Strict-Transport-Security response header (often abbreviated as HSTS) lets a web site tell browsers that it should only be accessed using HTTPS, instead of using HTTP.
| Value | Description |
|---|---|
| The time, in seconds, that the browser should remember that this site is only to be accessed using HTTPS. |
| If this optional parameter is specified, this rule applies to all of the site’s subdomains as well. |
max-age=<expire-time> The time, in seconds, that the browser should remember that a site is only to be accessed using HTTPS.
includeSubDomains Optional If this optional parameter is specified, this rule applies to all of the site's subdomains as well.
preload Optional See Preloading Strict Transport Security for details. Not part of the specification.
A Content Security Policy (CSP) requires careful tuning and precise definition of the policy. If enabled, CSP has significant impact on the way browsers render pages (e.g., inline JavaScript disabled by default and must be explicitly allowed in policy). CSP prevents a wide range of attacks, including Cross-site scripting and other cross-site injections.
| Directive | Description |
|---|---|
| Define the base URI for relative URIs. |
| Define loading policy for all resources type in case a resource type’s dedicated directive is not defined (fallback). |
| Define which scripts the protected resource can execute. |
| Define from where the protected resource can load plugins. |
| Define which styles (CSS) can be applied to the protected resource. |
| Define from where the protected resource can load images. |
| Define from where the protected resource can load video and audio. |
| (Deprecated and replaced by |
| Define from where the protected resource can embed frames. |
| Define from where the protected resource can be embedded in frames. |
| Define from where the protected resource can load fonts. |
| Define which URIs the protected resource can load using script interfaces. |
| Define from where the protected resource can load manifests. |
| Define which URIs can be used as the action of HTML form elements. |
| Specifies an HTML sandbox policy that the user agent applies to the protected resource. |
| Define script execution by requiring the presence of the specified nonce on script elements. |
| Define the set of plugins that can be invoked by the protected resource by limiting the types of resources that can be embedded. |
| Instruct the user agent to activate or deactivate any heuristics used to filter or block reflected cross-site scripting attacks, equivalent to the effects of the non-standard |
| Prevent the user agent from loading mixed content. |
| Instruct the user agent to download insecure HTTP resources using HTTPS. |
| (Deprecated) Define information the user agent can send in the |
| (Deprecated and replaced by |
| Specifies a group (defined in the |
X-Frame-Options response header improve the protection of web applications against Clickjacking. It declares a policy communicated from a host to the client browser on whether the browser must not display the transmitted content in frames of other web pages.
| Value | Description |
|---|---|
| No rendering within a frame. |
| No rendering if origin mismatch. |
| Allows rendering if framed by frame loaded from DOMAIN. |
The Referrer-Policy HTTP header governs which referrer information, sent in the Referer header, should be included with requests made.
| Value | Description |
|---|---|
| The |
| This is the user agent’s default behavior if no policy is specified. The origin is sent as referrer to a-priori as-much-secure destination (HTTPS → HTTPS), but isn’t sent to a less secure destination (HTTPS → HTTP). |
| Only send the origin of the document as the referrer in all cases. (e.g. the document |
| Send a full URL when performing a same-origin request, but only send the origin of the document for other cases. |
| A referrer will be sent for same-site origins, but cross-origin requests will contain no referrer information. |
| Only send the origin of the document as the referrer to a-priori as-much-secure destination (HTTPS → HTTPS), but don’t send it to a less secure destination (HTTPS → HTTP). |
| Send a full URL when performing a same-origin request, only send the origin of the document to a-priori as-much-secure destination (HTTPS → HTTPS), and send no header to a less secure destination (HTTPS → HTTP). |
| Send a full URL (stripped from parameters) when performing a same-origin or cross-origin request. |
Setting this header will prevent the browser from interpreting files as something else than declared by the content type in the HTTP headers.
| Value | Description |
|---|---|
| Will prevent the browser from MIME-sniffing a response away from the declared content-type. |
Example
A cross-domain policy file is an XML document that grants a web client, such as Adobe Flash Player or Adobe Acrobat (though not necessarily limited to these), permission to handle data across domains. When clients request content hosted on a particular source domain and that content makes requests directed towards a domain other than its own, the remote domain needs to host a cross-domain policy file that grants access to the source domain, allowing the client to continue the transaction. Normally a meta-policy is declared in the master policy file, but for those who can’t write to the root directory, they can also declare a meta-policy using the X-Permitted-Cross-Domain-Policies HTTP response header.
| Value | Description |
|---|---|
| No policy files are allowed anywhere on the target server, including this master policy file. |
| Only this master policy file is allowed. |
| [HTTP/HTTPS only] Only policy files served with Content-Type: text/x-cross-domain-policy are allowed. |
| [FTP only] Only policy files whose file names are crossdomain.xml (i.e. URLs ending in /crossdomain.xml) are allowed. |
| All policy files on this target domain are allowed. |
No longer recommended. Deprecated.
Though some browsers might still support it, it may have already been removed from the relevant web standards, may be in the process of being dropped, or may only be kept for compatibility purposes.
Be aware that this feature may cease to work at any time.
