🎁 New User? Get 20% off your first purchase with code NEWUSER20 · ⚡ Instant download · 🔒 Secure checkout Register Now →
Menu

Categories

Security Intermediate

What is Security Headers?

HTTP response headers that instruct browsers to enable security features like XSS protection, framing prevention, and content type enforcement.

Essential security headers include Content-Security-Policy (control resource loading), X-Frame-Options (prevent clickjacking), X-Content-Type-Options: nosniff (prevent MIME sniffing), Strict-Transport-Security (force HTTPS), and Referrer-Policy (control referrer information).

Additional headers include Permissions-Policy (restrict browser features), X-XSS-Protection (legacy XSS filter), and Cross-Origin headers (CORP, COEP, COOP). Security headers are a crucial defense layer that requires no code changes — just server configuration.

Related Terms

SAST (Static Application Security Testing)
Automated analysis of source code to find security vulnerabilities without executing the application.
CSRF (Cross-Site Request Forgery)
An attack that tricks authenticated users into submitting unwanted requests to a web application they are logged into.
JWT (JSON Web Token)
A compact, self-contained token format used for securely transmitting information between parties as a JSON object.
Security Hardening
The process of reducing a system's attack surface by disabling unnecessary services, applying patches, and configuring security controls.
Certificate Pinning
A security technique that associates a host with its expected TLS certificate or public key, preventing man-in-the-middle attacks with fraudulent certificates.
Penetration Testing
An authorized simulated cyberattack on a system to evaluate its security defenses and identify vulnerabilities.
 View All Security Terms →