HTTP Codes and HeadersSecurity headers explained
A handful of response headers give browsers extra rules for your page. They do not replace safe code, but they limit the damage of mistakes.
A response that has them
GET /csp HTTP/1.1
Host: example.com
HTTP/1.1 200 OK
Date: Sat, 14 Nov 2026 10:00:00 GMT
Content-Type: text/html; charset=utf-8
Content-Security-Policy: default-src 'self'; img-src 'self' data:
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Content-Length: 13
<p>secure</p>What each header does
| Header | Meaning |
|---|---|
Strict-Transport-Security: max-age=31536000; includeSubDomains | After one visit, the browser uses only https for this site (and its subdomains) for the number of seconds given. Defined in RFC 6797 |
Content-Security-Policy: default-src 'self' | Content may load only from the page's own site. Rules per type (img-src, script-src) loosen or tighten it |
X-Content-Type-Options: nosniff | The browser must trust the Content-Type you send and not guess another type |
Referrer-Policy: strict-origin-when-cross-origin | When a visitor follows a link to another site, only the site name is sent along, and only over https |
How to start without breaking the site
- HSTS: send it only when the whole site works on https. Start with a short
max-age(for example 300), then raise it. A long value cannot be cancelled quickly, because browsers remember it. - CSP: begin with
Content-Security-Policy-Report-Only, which only reports violations and blocks nothing. Fix what it lists, then switch to the real header. - nosniff and Referrer-Policy are low risk: check that your files have the right
Content-Type, and add them.
What the header checker looks for
The checker on this site notes the absence of these four headers on an HTML page, flags a wrong nosniff value and a version number in the Server header. A missing header is a note, not a proof that a site is unsafe. Run it on the response your own server really sends, from the address of the page, not from a development server.
Do these headers stop all attacks?
No. They add a layer. Input checking, updates and strong passwords still matter.
Where do I set them?
In the web server or hosting settings, or in the application. On static hosting that cannot send custom headers, some of them can be set with <meta http-equiv> tags, but not all (HSTS cannot).
Sources
- RFC 6797 HTTP Strict Transport Security (rfc-editor.org/rfc/rfc6797)
- Fetch Standard, the X-Content-Type-Options header (fetch.spec.whatwg.org)
- Content Security Policy Level 3 (w3.org/TR/CSP3)
Read on 14 November 2026.
This is an independent guide. It is not connected with the IETF, IANA, any browser maker or any company named here. Meanings were checked against the RFC texts on 14 November 2026. Responses shown were recorded on 14 November 2026 from a small test server on the author's own computer.