Complete Guide to HTTP Security Headers & Web Server Hardening
HTTP response security headers are critical configuration directives transmitted from web servers (such as NGINX, Apache, Cloudflare, or Caddy) to client web browsers. These headers activate defense-in-depth browser mitigations against major cyber threat vectors including Cross-Site Scripting (XSS), Clickjacking iframe overlays, MIME-type sniffing, Cross-Site Leakage, and SSL/TLS protocol downgrade attacks.
HTTP Security Headers Specification Reference Table
| Security Header | Recommended Default Directive | Primary Protection Vector | OWASP Priority |
|---|---|---|---|
| Strict-Transport-Security (HSTS) | max-age=31536000; includeSubDomains; preload | SSL-stripping, MITM attacks, insecure HTTP protocol downgrades | Critical |
| Content-Security-Policy (CSP) | default-src 'self'; script-src 'self' https:; | Stored & Reflected Cross-Site Scripting (XSS), malicious script injection | Critical |
| X-Frame-Options | DENY or SAMEORIGIN | Clickjacking, UI redressing, hidden iframe exploitation | High |
| X-Content-Type-Options | nosniff | MIME-type sniffing, executing uploaded images as executable scripts | High |
| Referrer-Policy | strict-origin-when-cross-origin | Sensitive URL parameter leaks, token leakage in Referer headers | Medium |
| Permissions-Policy | camera=(), microphone=(), geolocation=() | Unauthorized hardware sensor access, rogue third-party tracker APIs | Medium |
Best Practices for NGINX and Apache Hardening
When deploying response headers, always test in staging environments before applying strict Content Security Policies to production. Utilize the remediation generator above to copy pre-verified header blocks directly into your NGINX server { ... } blocks or Apache .htaccess files.