All Cheat SheetsSecurity
HTTP Security Headers Cheat Sheet
HSTS, CSP, framing, MIME sniffing, Referrer-Policy, and CORS
Transport & framing
HSTSForce HTTPS for a year; submit to preload list only when ready
Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadClickjackingPrefer CSP frame-ancestors for modern browsers
X-Frame-Options: DENY
Content-Security-Policy: frame-ancestors 'none'Content security
Minimal CSPTighten script-src; avoid 'unsafe-inline' when possible
Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'MIME sniffing
X-Content-Type-Options: nosniffReferrer
Referrer-Policy: strict-origin-when-cross-originPermissions
Permissions-Policy: camera=(), microphone=(), geolocation=()CORS pitfalls
Never with credentialsInvalid / dangerous combination — reflect a specific origin instead
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: truePreflight basics
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: Authorization, Content-TypeQuick grade targets
Baseline A
HSTS + CSP + XFO/frame-ancestors + nosniff + Referrer-PolicyAudit locallyNothing leaves the browser
Paste DevTools response headers into HTTP Headers Inspector