HTTP Security Headers: An Implementation Guide for 2026

• Start with CSP in Report-Only mode. Use default-src 'self', nonces for inline scripts, and frame-ancestors 'self'. Keep reporting enabled during and after rollout.
• HSTS preload is nearly irreversible. As of April 2026, approximately 120,000 domains are in the Chrome preload list. Only submit when every subdomain serves HTTPS and you have documented business approval.
• The report-to directive is now Baseline 2026. Since March 2026, report-to works across latest browsers. Support for the older Report-To header is declining; migrate to Reporting-Endpoints + report-to.
• Stop using HPKP, X-XSS-Protection, and Expect-CT. These headers are deprecated or removed. Use HSTS, CSP, and rely on Certificate Transparency instead.
• Set X-Content-Type-Options: nosniff on every response. No exceptions. Low risk, material security improvement.
• Lock cookies with Secure; HttpOnly; SameSite=Lax. Use SameSite=None; Secure only for third-party contexts.

1. Treat headers as configuration as code. Keep them in version control alongside your application.
2. Roll out with report-only first. Use Content-Security-Policy-Report-Only and monitor violations before enforcing.
3. Validate in CI. Use curl checks and automated scanners in your pipeline.
4. Use DAST in staging and production. Confirm real-world behavior.
5. Revisit policies when you add third-party scripts, new APIs, or new features.

Content-Security-Policy-Report-Only: default-src 'self'; base-uri 'self'; object-src 'none'; script-src 'self' 'nonce-{RANDOM}'; style-src 'self'; img-src 'self' data:; frame-ancestors 'self'; upgrade-insecure-requests; report-to csp-endpoint

Content-Security-Policy: default-src 'self'; base-uri 'self'; object-src 'none'; script-src 'self' 'nonce-{RANDOM}' 'strict-dynamic'; style-src 'self' 'nonce-{RANDOM}'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; form-action 'self'; upgrade-insecure-requests

Reporting-Endpoints: csp-endpoint="https://example.com/csp-reports"
Content-Security-Policy: ... report-to csp-endpoint

Strict-Transport-Security: max-age=31536000; includeSubDomains

• max-age ≥ 31,536,000 (one year)
• includeSubDomains
• preload directive
• An HTTP-to-HTTPS redirect on the apex domain

Referrer-Policy: strict-origin-when-cross-origin

Referrer-Policy: no-referrer

Permissions-Policy: geolocation=(), camera=(), microphone=()

1. Search your code for feature APIs (geolocation, camera, microphone, payment, usb, fullscreen).
2. Use DevTools to see prompts and blocked features.
3. Open policies for routes that need them.

X-Content-Type-Options: nosniff

Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Resource-Policy: same-origin

• You need SharedArrayBuffer or performance APIs that require isolation
• You want stronger protections against cross-site leaks and popup communication

• Images, fonts, or WASM failing to load under COEP usually lack Cross-Origin-Resource-Policy. Add CORP: same-origin on your assets.
• Third-party widgets may not embed under COEP. Host them first-party or use credentialless.

Access-Control-Allow-Origin: https://example.com
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Credentials: true
Access-Control-Max-Age: 600
Vary: Origin

Access-Control-Allow-Origin: https://example.com
Access-Control-Allow-Credentials: true
Vary: Origin

• Never use Access-Control-Allow-Origin: * with credentials. The spec forbids this, and browsers reject it.
• Always set Vary: Origin when responses differ by origin.
• Allow only necessary methods and headers. Avoid Access-Control-Allow-Headers: *.
• Keep Access-Control-Max-Age modest (e.g., 600 seconds) so policy changes take effect quickly.

site = get_header("Sec-Fetch-Site")
mode = get_header("Sec-Fetch-Mode")
is_unsafe_method = (method in [POST, PUT, PATCH, DELETE])
is_cross_site = (site == "cross-site")
is_navigational = (mode == "navigate")
if (is_cross_site && is_unsafe_method && !is_navigational) {
 reject()
}

function fetchMetadataGuard(req, res, next) {
 const site = req.get("Sec-Fetch-Site") || "";
 const mode = req.get("Sec-Fetch-Mode") || "";
 const dest = req.get("Sec-Fetch-Dest") || "";
 const unsafe = ["POST", "PUT", "PATCH", "DELETE"].includes(req.method);
 const allowedSameSite = site === "" || site === "same-origin" || site === "same-site";
 const isNavigation = mode === "navigate" && dest === "document";
 if (unsafe && !allowedSameSite && !isNavigation) return res.sendStatus(403);
 next();
}

<script src="https://cdn.example.com/app.js"
 integrity="sha384-BASE64HASH"
 crossorigin="anonymous"></script>

• SHA-384 is the recommended choice-a good balance between security and hash length. SHA-512 is also acceptable.
• Always include the crossorigin attribute. Browsers silently ignore SRI without it.
• Automate hash updates using build tools. Broken hashes break your site.
• Pin to immutable versioned URLs. SRI cannot protect content that is designed to change.

openssl dgst -sha384 -binary app.js | openssl base64 -A

Set-Cookie: session=abc...; Path=/; Secure; HttpOnly; SameSite=Lax

• Set Path=/ only when needed. Narrower paths reduce exposure.
• Scope Domain to the fewest hosts possible.
• Rotate session IDs on login and privilege changes.
• Use short expirations for session cookies.
• Use SameSite=None; Secure only for third-party cookies.

# /etc/nginx/conf.d/security.conf
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(), camera=(), microphone=()" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Cross-Origin-Opener-Policy "same-origin" always;
add_header Cross-Origin-Embedder-Policy "require-corp" always;
add_header Cross-Origin-Resource-Policy "same-origin" always;
location / {
 set_by_lua_block $csp_nonce {
 local rand = require("resty.random").bytes(16, true)
 return ngx.encode_base64(rand)
 }
 add_header Content-Security-Policy
 "default-src 'self'; base-uri 'self'; object-src 'none'; \
 script-src 'self' 'nonce-$csp_nonce'; style-src 'self'; img-src 'self' data:; \
 frame-ancestors 'self'; upgrade-insecure-requests" always;
}

# In <VirtualHost> or .htaccess
Header always set Content-Security-Policy "default-src 'self'; base-uri 'self'; object-src 'none'; script-src 'self' 'nonce-%{CSP_NONCE}e'; style-src 'self'; img-src 'self' data:; frame-ancestors 'self'; upgrade-insecure-requests"
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set X-Content-Type-Options "nosniff"

import express from "express";
import crypto from "crypto";
const app = express();
app.use((req, res, next) => {
 res.locals.cspNonce = crypto.randomBytes(16).toString("base64");
 next();
});
app.use((req, res, next) => {
 const nonce = res.locals.cspNonce;
 res.setHeader("Content-Security-Policy",
 "default-src 'self'; base-uri 'self'; object-src 'none'; " +
 "script-src 'self' 'nonce-" + nonce + "'; style-src 'self'; img-src 'self' data:; " +
 "frame-ancestors 'self'; upgrade-insecure-requests");
 res.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
 res.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
 res.setHeader("X-Content-Type-Options", "nosniff");
 next();
});

# Show all response headers
curl -s -D - https://example.com/ -o /dev/null
# Check HSTS
curl -s -D - https://example.com/ -o /dev/null | grep -i strict-transport-security
# Check CORS preflight
curl -s -D - -X OPTIONS https://api.example.com/endpoint \
 -H "Origin: https://example.com" \
 -H "Access-Control-Request-Method: POST" -o /dev/null

• Chrome: Network tab → select document → Response Headers
• Firefox: Storage panel → Cookies → check Secure, HttpOnly, SameSite flags
• Console: Reload to see CSP violations while in Report-Only

• securityheaders.com
• observatory.mozilla.org

1. CSP is the most powerful header. Start in Report-Only, use nonces for inline scripts, and keep reporting enabled. Since March 2026, report-to is Baseline-migrate from report-uri.
2. HSTS preload is nearly irreversible. As of April 2026, only 35.7% of sites that ship HSTS use the preload directive. Submit only when you are certain.
3. X-Content-Type-Options: nosniff goes on every response. No exceptions.
4. CORS with credentials: never use *. Always set Vary: Origin.
5. Test your headers. Use curl, browser DevTools, securityheaders.com, and observatory.mozilla.org.
6. Roll out gradually. Start with report-only, monitor, then enforce. HSTS should be ramped up over weeks.
7. Permissions-Policy is experimental. Check browser compatibility before deploying in production.

• MDN HTTP header reference
• MDN CSP guide
• W3C Content Security Policy Level 3
• MDN HSTS
• OWASP HSTS Cheat Sheet
• MDN Referrer-Policy
• MDN Permissions-Policy
• MDN X-Content-Type-Options
• MDN COOP
• MDN COEP
• MDN CORP
• MDN CORS guide
• WICG Fetch Metadata
• MDN CSRF overview
• MDN SRI
• W3C SRI
• OWASP Secure Headers Project
• OWASP HTTP Headers Cheat Sheet
• Mozilla HTTP Observatory
• SecurityHeaders.com
• OWASP ZAP