Begin with a deny-by-default story
Content Security Policy controls which resources a page may load and can restrict framing through frame-ancestors. X-Content-Type-Options prevents MIME sniffing, while Referrer-Policy limits information carried to another origin.
Permissions-Policy can disable browser capabilities such as camera or geolocation when the site does not need them. A narrow policy makes future feature requests explicit instead of granting capability by accident.
HSTS changes future navigation
Strict-Transport-Security tells a browser to use HTTPS for later requests after it has received the header over a secure connection. It does not repair the very first insecure visit, so redirects and preload decisions still need careful deployment planning.
The includeSubDomains and preload options extend the promise. Enable them only after verifying that every relevant subdomain can remain on HTTPS for the declared period.
- Set headers at a common edge or framework boundary.
- Test representative HTML, API, file, and error responses.
- Roll CSP out in report-only mode before enforcement.
- Monitor drift so a proxy change does not silently remove policy.
Avoid checklist security
Some headers are redundant in modern browsers, and some values can break legitimate embedding or cross-origin isolation. The right set depends on the product’s resource and integration model.
Document the intent beside the configuration: what attack or browser behavior each directive addresses, who owns exceptions, and how the control is tested. That turns headers into maintainable engineering rather than decorative scores.