GUIDE深度 · Deep dive
Common HTTP Security Headers
Security headers are one layer of defense: CSP restricts script sources, HSTS forces HTTPS, nosniff blocks MIME sniffing, frame headers stop clickjacking, referrer controls leakage and permissions restrict browser features.
Start with
HSTS: max-age of at least six months after confirming HTTPS everywhere.
X-Content-Type-Options: nosniff.
X-Frame-Options: DENY or CSP frame-ancestors.
CSP
Observe with Report-Only first, then enforce.
Avoid unsafe-inline; use nonces/hashes.
FAQ
Can HSTS be undone?
Browsers cache max-age; rollback is hard during that window, so test with a short max-age first.
Can CSP break pages?
Yes, especially inline scripts/third parties; use Report-Only first.