Access and configuration
Set security headers
Add a deliberate baseline for framing, content types, referrers, browser features, transport, and content loading.
8 minute lesson
Security headers activate browser protections and remove ambiguous behavior. Choose each header for the application instead of copying an unexplained block.
A useful baseline often includes CSP, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, framing controls, and HSTS after HTTPS is complete. Test headers on real routes, errors, and redirects—not only the home page.
The home page has a strong header set, but framework-generated 404 and 500 responses omit it. An attacker targets the forgotten route where browser protections differ.
Copying every recommended header can break required features or advertise a false policy. Choose values from the application’s real content, framing, and referrer needs.
Capture headers for a normal page, login, redirect, static file, 404, and forced 500. Compare them against the intended baseline and test one blocked framing or MIME-sniffing behavior in a browser.
Lesson completed