Set security headers on all HTTP responses: Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security. Missing headers leave your app vulnerable to XSS, clickjacking, MIME sniffing, and protocol downgrade attacks.
Why This Matters
Missing security headers leave your application exposed to well-known attack vectors. Without Content-Security-Policy, XSS attacks execute freely. Without X-Frame-Options, your site can be embedded in an attacker's iframe for clickjacking. Without HSTS, connections can be downgraded from HTTPS to HTTP for man-in-the-middle attacks.
HTTP security headers are a defense-in-depth layer that mitigates common web attacks even when other defenses fail. They are set once in your server configuration and protect every page and API response.
Without these headers:
No Content-Security-Policy (CSP): Injected scripts execute freely. CSP restricts which scripts can run, which sources can be loaded, and blocks inline script execution — dramatically reducing XSS impact.
No X-Frame-Options: Your pages can be embedded in an attacker's iframe, enabling clickjacking attacks where users interact with your hidden site while seeing a fake overlay.
No HSTS: Connections can be downgraded from HTTPS to HTTP via an SSL stripping attack, exposing session cookies and credentials in transit.
No X-Content-Type-Options: Browsers may MIME-sniff responses and execute uploaded files as scripts.