All recipes
Copy-paste HTTP security headers, grouped by header and by server.
Essentials
By header
- COOP, COEP & CORP: Cross-Origin Isolation Headers4 min
- CORS Done Right: Access-Control-Allow-Origin Without the Wildcard4 min
- A Content-Security-Policy That Won't Break Your Site (Starter)5 min
- Strict-Transport-Security (HSTS): Copy-Paste + Preload3 min
- Permissions-Policy: Disable Camera, Mic & Geolocation (Copy-Paste)3 min
- Referrer-Policy: Which Value to Use (Copy-Paste)2 min
- Hide Server & X-Powered-By Headers (Reduce Fingerprinting)3 min
- X-Content-Type-Options: nosniff (Copy-Paste)2 min
- Stop Clickjacking: X-Frame-Options & CSP frame-ancestors3 min
By server