Show Menu
Cheatography
  1. Home >
  2. Programming >

HTTP Security Headers Cheat Sheet by

What each common HTTP security header does, a safe starting value, and what breaks if you get it wrong.

Security headers

Header
What it does
Safe starting value
Watch out for
Strict­-Tr­ans­por­t-S­ecurity
Tells browsers to use HTTPS only for this host
 
max-ag­e=3­153­6000; includ­eSu­bDo­mains
Only add 
preload
once every subdomain serves HTTPS
Conten­t-S­ecu­rit­y-P­olicy
Limits where scripts, styles and frames may load from
Start with 
Conten­t-S­ecu­rit­y-P­oli­cy-­Rep­ort­-Only
and a 
defaul­t-src 'self'
policy
Inline scripts and third-­party widgets break until they're allowed
X-Fram­e-O­ptions
Stops other sites framing your pages (click­jac­king)
 
SAMEORIGIN
Being replaced by CSP 
frame-­anc­estors
; send both for older browsers
X-Cont­ent­-Ty­pe-­Options
Stops MIME-type sniffing
 
nosniff
Files served with the wrong Conten­t-Type stop working
Referr­er-­Policy
Controls how much of the URL is sent as Referer
 
strict­-or­igi­n-w­hen­-cr­oss­-origin
 
no-ref­errer
can break analytics attrib­ution
Permis­sio­ns-­Policy
Turns off browser features you don't use
 
camera=(), microp­hon­e=(), geoloc­ati­on=()
Don't block a feature a page actually needs
Check headers after every server or CDN change. A rewrite rule or proxy can quietly drop them. Test the final URL after redirects, not just the bare domain.
                   
 

Metadata

  • Languages:
  • Published: 31st October, 2026

Comments

No comments yet. Add yours below!

Add a Comment

Your Comment

Please enter your name.

    Please enter your email address

      Please enter your Comment.

          Related Cheat Sheets

          HTTP Status Codes Cheat Sheet
          cURL cheat sheet Cheat Sheet