HTTP Security Headers

HTTP Security Headers are HTTP response headers returned by a web server that instruct the user's web browser to enforce security protections. Enabling these headers strengthens site defense against cross-site scripting (XSS), clickjacking, drive-by downloads, session hijacking, and downgrade attacks.

Deploying properly configured security headers is a core component of web application hardening for web applications and API endpoints.

Core HTTP Security Headers

Header	Purpose	Recommended Value / Baseline
Content-Security-Policy (CSP)	Restricts loaded scripts, styles, images, and endpoints to authorized domains, mitigating XSS and data injection attacks.	`default-src 'self'; script-src 'self'; object-src 'none';`
Strict-Transport-Security (HSTS)	Enforces HTTPS connections and prevents SSL stripping attacks.	`max-age=31536000; includeSubDomains; preload`
X-Frame-Options	Protects users against clickjacking by restricting whether the site can be embedded in `<frame>`, `<iframe>`, or `<object>` elements.	`DENY` or `SAMEORIGIN`
X-Content-Type-Options	Prevents browsers from MIME-sniffing response content types, forcing adherence to declared `Content-Type` headers.	`nosniff`
Referrer-Policy	Controls how much referrer information is sent along with requests when users click external links.	`strict-origin-when-cross-origin`
Permissions-Policy	Enables or disables access to hardware features (camera, microphone, geolocation, payment APIs) in the browser.	`geolocation=(), microphone=(), camera=()`

Detailed Header Descriptions & Examples

1. Content-Security-Policy (CSP)

CSP reduces XSS risk by declaring approved content origins:

 http
Content-Security-Policy: default-src 'self'; script-src 'self' https://trustedscripts.example.com; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests;

2. HTTP Strict Transport Security (HSTS)

HSTS ensures web browsers interact with your web server strictly via encrypted HTTPS connections:

 http
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

max-age: Duration (in seconds) that the browser remembers to enforce HTTPS (31536000 = 1 year).
includeSubDomains: Applies rule to all subdomains (e.g., `wiki.telenegar.ir`).
preload: Qualifies the domain for inclusion in browser HSTS preload lists.

3. X-Frame-Options

Defends against clickjacking overlays:

 http
X-Frame-Options: SAMEORIGIN

4. X-Content-Type-Options

Prevents executable content masquerading as benign media assets:

 http
X-Content-Type-Options: nosniff

5. Referrer-Policy

Protects sensitive path data from leaking to third-party destinations:

 http
Referrer-Policy: strict-origin-when-cross-origin

Server Configuration Examples

Nginx

Add these directives inside your `server` block:

 nginx
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';" always;

Apache (`.htaccess` or `httpd.conf`)

Ensure `mod_headers` is enabled and add:

 apache
<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';"
</IfModule>

Verification & Testing

You can verify and test your HTTP Security Header implementation using Telenegar Tools or terminal commands:

Using Telenegar Tools

DNS & Web Check: Verify domain configuration and SSL/TLS health using the Telenegar DNS Check Tool.
Mail Security Check: Audit domain security headers alongside email records using the Telenegar Mail Check Tool.

Using Terminal Commands

curl (Linux / macOS)

 bash
curl -I https://telenegar.ir

Telenegar Knowledge Base

Table of Contents