HTTP Headers & Security Directives Directory

Restricts where scripts, images, styles, and frames can be loaded from, protecting websites from Cross-Site Scripting (XSS) and data injection attacks.

Forces modern web browsers to communicate exclusively over encrypted HTTPS connections, preventing SSL stripping and man-in-the-middle (MITM) attacks.

Indicates whether a browser should be allowed to render a page inside an <iframe>, <frame>, or <object>, protecting users against clickjacking attacks.

Prevents the browser from MIME-sniffing a response away from the declared Content-Type header, mitigating drive-by malware and MIME confusion attacks.

Controls how much referrer information (URL path and query parameters) is included when navigating away or loading external assets.

Allows site owners to selectively restrict browser hardware features, sensors, APIs, and privacy-invasive tracking mechanisms.

Specifies browser and CDN caching directives for requests and responses, dramatically accelerating load speeds or preventing cache leakage.

Tells browsers which specific origins are permitted to access resources via XMLHttpRequest or Fetch API across domains.

Contains the client credentials used to authenticate a user agent with the server, most commonly holding JWT or OAuth access tokens.

Transfers session cookies from server to client with security flags controlling JavaScript access, cross-site transmission, and SSL encryption.

Isolates your top-level browsing context from other origins, preventing cross-origin window tampering and Spectre side-channel attacks.

Unique hash or identifier for a specific version of a resource, allowing efficient cache revalidation with 304 Not Modified responses.