Security Headers

HTTP headers that strengthen security: CSP restricts script sources, HSTS enforces HTTPS, and X-Frame-Options protects against clickjacking.

Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options. CSP is the most powerful, but it needs to be configured for your site.

In Nginx, use add_header; in Apache, use Header set. For Next.js, use next.config.js headers. Start with simple settings (X-Frame-Options: DENY) and configure CSP gradually.

CSP blocks scripts and styles from unapproved sources. Add domains one at a time and check the console. Use report-only for testing.

Security Headers loads the page and extracts response headers. Alternatively, use DevTools → Network → select the document → Headers.