HTTP response headers can instruct the browser to apply additional security restrictions. Missing headers do not automatically prove exploitation, but they can increase the impact of other weaknesses.
Content Security Policy
Content Security Policy controls which scripts, styles, frames, forms and other resources the browser may load.
A strong CSP should be designed for the actual application. Copying a generic policy without testing may break required functionality.
Important CSP directives
default-srcscript-srcstyle-srcobject-srcbase-uriframe-ancestorsform-action
HTTP Strict Transport Security
HSTS tells browsers to use HTTPS for future requests. It should be enabled only after HTTPS works correctly across every required hostname.
Clickjacking protection
The CSP frame-ancestors directive controls which websites may embed a page. X-Frame-Options can provide additional legacy browser coverage.
MIME sniffing protection
X-Content-Type-Options: nosniff prevents browsers from interpreting content as a different MIME type.
Referrer and permissions policies
Referrer-Policy controls how much URL information is shared with other sites. Permissions-Policy limits access to browser capabilities such as camera, microphone and geolocation.
Implementation advice
Add headers in a test environment, verify application behavior and deploy gradually. CSP can begin in report-only mode before enforcement.