Recommended Values for Security relevant HTTP Headers

Muhammad Akbar
Jun 19, 2019

Web-Security
HTTP
XSS
CSP
HSTS

The strict recommended values for security relevant HTTP Headers are provided below. Remember, one size doesn’t fit all.

X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'none'; upgrade-insecure-requests;
Strict-Transport-Security: max-age=31536000; includeSubDomains