HTTP Security Headers Suite: HSTS, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.

Production Security Headers Reference

Configuring modern HTTP security response headers transforms standard web browsers into fortified execution environments.

+--------------------------------------------------------------------------+
|                  Recommended Production Security Headers                 |
+--------------------------------------------------------------------------+
| Strict-Transport-Security: max-age=63072000; includeSubDomains; preload  |
| X-Content-Type-Options: nosniff                                          |
| X-Frame-Options: DENY                                                    |
| Referrer-Policy: strict-origin-when-cross-origin                         |
| Permissions-Policy: camera=(), microphone=(), geolocation=()             |
| Cross-Origin-Opener-Policy: same-origin                                  |
| Cross-Origin-Resource-Policy: same-origin                                |
+--------------------------------------------------------------------------+

Header Specifications

1. Strict-Transport-Security (HSTS): Forces browser to communicate exclusively over HTTPS for the next 2 years (63,072,000 seconds). Defends against SSL stripping attacks.
2. X-Content-Type-Options: nosniff: Blocks browsers from MIME-sniffing responses away from the declared Content-Type (e.g. executing a user-uploaded avatar.jpg as malicious JavaScript).
3. Referrer-Policy: strict-origin-when-cross-origin: Sends the full URL path on same-origin requests, but sends only the domain on cross-origin HTTPS requests, preventing token leakage in URL query parameters.
4. Permissions-Policy: Explicitly disables hardware APIs (camera, microphone, accelerometer, USB) that your application does not require.