Proper HTTP security headers are the cheapest security measure. One line of configuration can stop entire categories of attacks.

Complete Set — Nginx¶

add_header Strict-Transport-Security “max-age=63072000; includeSubDomains; preload” always; add_header X-Frame-Options “DENY” always; add_header X-Content-Type-Options “nosniff” always; add_header Referrer-Policy “strict-origin-when-cross-origin” always; add_header Permissions-Policy “camera=(), microphone=(), geolocation=()” always; add_header Content-Security-Policy “default-src ‘self’” always; add_header Cross-Origin-Opener-Policy “same-origin” always;

What Each Header Does¶

• HSTS: Enforces HTTPS, prevents SSL stripping
• X-Frame-Options: Prevents clickjacking
• X-Content-Type-Options: Prevents MIME sniffing
• Referrer-Policy: Controls Referer header
• Permissions-Policy: Limits access to APIs (camera, GPS)

Testing¶

curl -I https://example.com

Online: securityheaders.com, observatory.mozilla.org¶

Key Takeaway¶

Add all security headers. Takes 5 minutes, protects against clickjacking, XSS, MIME sniffing.