Security headers tell browsers how to treat your responses. They’re cheap to add and expensive to ignore. Misconfigured CSP can break production; missing HSTS leaves room for downgrade attacks. Roll out deliberately.
Content-Security-Policy
CSP reduces XSS impact by limiting where scripts, styles, and connections can come from. A policy full of 'unsafe-inline' and wildcards mostly performs theater.
- Start with default-src 'self', then open only what you need.
- Prefer nonces or hashes over 'unsafe-inline' for scripts.
- Set object-src 'none' and base-uri 'self'.
- Ship Content-Security-Policy-Report-Only first; fix violations, then enforce.
HSTS and framing controls
- Strict-Transport-Security with a long max-age (and includeSubDomains when ready).
- Only enable HSTS once HTTPS works everywhere — including apex and www.
- Use CSP frame-ancestors (or X-Frame-Options) to block clickjacking.
- DENY or SAMEORIGIN for most apps; allow specific parents only when embedding is intentional.
Supporting headers worth setting
- X-Content-Type-Options: nosniff
- Referrer-Policy: strict-origin-when-cross-origin (or stricter)
- Permissions-Policy to disable camera, mic, and geo unless required
Rollout without breaking prod
Change one header family at a time. Watch browser console reports and real-user error rates. Document exceptions (payment iframes, analytics domains) so the next engineer doesn’t “fix” CSP by widening it again.
Health Mesh fetches live headers on security scans, grades CSP weaknesses, and lists concrete hardening steps from quick wins to stricter policies.