Question 1

Which security headers should every website have?

Accepted Answer

The most critical security headers are: Content-Security-Policy (CSP) to prevent XSS, Strict-Transport-Security (HSTS) to enforce HTTPS, X-Frame-Options or CSP frame-ancestors to prevent clickjacking, X-Content-Type-Options: nosniff to stop MIME sniffing, and Referrer-Policy to control referrer leakage. Permissions-Policy is also increasingly important to restrict browser feature access.

Question 2

What is HSTS and why is it important?

Accepted Answer

HTTP Strict Transport Security (HSTS) tells browsers to always use HTTPS for a domain, never HTTP, for a set duration (max-age). Once a browser sees this header, it will refuse to connect over plain HTTP — even if the user types http:// manually. The includeSubDomains directive extends this to all subdomains, and preload allows listing the site in browser preload lists.

Question 3

What do CORS headers like Access-Control-Allow-Origin do?

Accepted Answer

CORS (Cross-Origin Resource Sharing) headers control which origins can make cross-origin requests to your server. Access-Control-Allow-Origin specifies allowed origins (use specific origins, not * for authenticated endpoints). Access-Control-Allow-Methods lists allowed HTTP methods and Access-Control-Allow-Headers lists allowed request headers. These headers are set on the server response, not the request.

Question 4

How do Cache-Control and ETag work together?

Accepted Answer

Cache-Control sets the caching policy (e.g., max-age=3600, no-cache, no-store). ETag is a fingerprint of the response content. When a cached response expires, the browser sends the ETag in an If-None-Match request header. If the content hasn't changed, the server replies with 304 Not Modified (no body), saving bandwidth. Cache-Control: no-cache means 'always revalidate', not 'don't cache'.

Question 5

What is Content-Security-Policy and how do I set it?

Accepted Answer

CSP is a response header that tells browsers which sources of scripts, styles, images and other resources are allowed to load. A basic CSP like 'default-src self; script-src self https://cdn.example.com' blocks all resources except from your own origin and the specified CDN. Start with Content-Security-Policy-Report-Only to test without blocking, then switch to enforcement mode. Avoid 'unsafe-inline' and 'unsafe-eval' directives as they weaken XSS protection.

HTTP Header Analyzer

Frequently Asked Questions

Comments & Feedback