security headers best practices
Security headers work best when you set priorities instead of adding everything at once. Start with the headers that change browser behavior the most.
Recommended priority
- Content-Security-Policy for resource loading rules.
- Strict-Transport-Security to keep browsers on HTTPS.
- X-Content-Type-Options: nosniff to reduce content-type abuse.
- Referrer-Policy to reduce referrer leakage.
- X-Frame-Options or frame-ancestors for anti-clickjacking.
- Permissions-Policy to disable browser features you do not need.
Rollout order
- Ship CSP in report-only mode.
- Observe violations for one or two days.
- Whitelist real dependencies only.
- Replace unsafe inline allowances.
- Enforce CSP and keep monitoring.