CSPStatic Security ToolsTooling for static and headless sites
Home/Security Headers for Static Sites
Scenario

Security Headers for Static Sites

Static sites can still ship a strong security baseline. The key is to set the important response headers in the layer that actually serves HTML and assets.

Core headers to start with

  • Content-Security-Policy
  • Strict-Transport-Security
  • X-Content-Type-Options: nosniff
  • Referrer-Policy
  • X-Frame-Options or frame-ancestors
  • Permissions-Policy

Platform note

Platforms like Cloudflare Pages, Netlify, and Vercel each expose different header configuration layers. Always verify the live response after deployment, because the file you committed is not always the header the browser received.

Official references