HTTP Headers
Everything about HTTP security headers: CSP, HSTS, Referrer-Policy and more.
Guides
- HTTP Security Headers: A Practical GuideEvery HTTP security header explained in plain English, with production-ready examples for Nginx, Apache, Cloudflare, Express and WordPress.
- Content Security Policy (CSP): What It Is and How to Ship ItA step-by-step guide to writing, testing and shipping a strict Content Security Policy without breaking your site.
- HTTP Strict Transport Security (HSTS)How HSTS works, how to enable it safely, and when (and how) to preload your domain into every major browser.
- Referrer-PolicyReferrer-Policy controls how much of your URL is sent to other sites. Here's the setting that balances analytics with privacy.
- Permissions-PolicyTurn off camera, microphone, geolocation and other powerful browser APIs for your site and any iframes you embed.
Articles
- Why Your Website Needs HSTS in 2026One header, one config line, and downgrade attacks stop reaching your users. If your site doesn't ship HSTS in 2026, you're leaving free security on the table.
- How to Roll Out CSP in Report-Only ModeCSP is one of the most effective XSS defenses ever shipped — and one of the most feared to deploy. Report-only mode turns a scary launch into a boring one.