Web › Module 5 › Lesson 2
Security Headers & CSP
HSTS, CSP, and related HTTP headers that tell browsers how to harden your site
Visual · web_developer
Security headers are cheap, server-side instructions. CSP in particular reduces XSS blast radius by controlling scripts, frames, and connections.
Opening
Headers are your browser contract
You cannot trust every user’s browser extensions or every developer’s inline script habit. HTTP response headers let the server declare: “Only load scripts from these origins,” “Always use HTTPS,” “Do not embed me in iframes.” They do not replace secure coding—but they add defense in depth.
1. Headers Worth Setting
Strict-Transport-Security (HSTS)
Forces HTTPS for future visits; includeSubDomains carefully.
Content-Security-Policy (CSP)
Controls script/style/frame/connect sources; use nonces in modern apps.
X-Content-Type-Options: nosniff
Stops MIME-type sniffing that turns uploads into executable content.
Referrer-Policy
Limits leakage of URL paths in Referer headers.
2. Starter CSP
Example CSP header (tune for your app)selfselfnonce-random123selfnonce-random123noneselfnone
selfselfnonce-random123selfnonce-random123noneselfnone
Start in Report-Only mode to collect violations without breaking users: Content-Security-Policy-Report-Only: ...; report-uri /csp-report Replace inline script habits with nonces or external files before enforcing.
3. Verify With curl
Inspect headers on your sitecurl -sI https://yourdomain.example | grep -iE \\ "strict-transport|content-security|x-frame|x-content-type"
curl -sI https://yourdomain.example | grep -iE \\ "strict-transport|content-security|x-frame|x-content-type"
CSP is not copy-paste
Third-party widgets (analytics, payment iframes) need explicit allowlist entries. Test staging thoroughly—overly strict CSP breaks checkout flows.
Knowledge Check
HSTS primarily enforces:
Multiple choice
Knowledge Check
True or False: CSP can restrict which scripts and frames load on a page.
True or False
Knowledge Check
frame-ancestors in CSP helps prevent:
Multiple choice