CSP, HSTS, X-Frame-Options: The Three Headers That Stop Most Attacks

Defensive HTTP headers are some of the highest-leverage security work you can do. They are configuration changes, not code changes, and they kill entire classes of attack at the browser level.

Content-Security-Policy (CSP)

CSP tells the browser which sources of script, style and content are allowed to execute on your page. A strict CSP eliminates most XSS impact — even if an attacker injects a script tag, the browser refuses to run it.

Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-RANDOM';
  style-src 'self'; img-src 'self' data: https:; object-src 'none';
  base-uri 'self'; frame-ancestors 'none'

Strict-Transport-Security (HSTS)

HSTS forces browsers to use HTTPS for your domain even if the user types http://. This kills downgrade attacks at the network layer.

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

X-Frame-Options / frame-ancestors

This prevents attackers from embedding your site in an iframe on a malicious page — the foundation of clickjacking attacks.

X-Frame-Options: DENY

If you also use CSP, the modern equivalent is frame-ancestors 'none', which is preferred.

Honorable mentions

• Referrer-Policy: strict-origin-when-cross-origin to avoid leaking sensitive URLs.
• Permissions-Policy to disable browser APIs you do not use.
• X-Content-Type-Options: nosniff to stop MIME-type guessing.

Headers do not replace secure code — but they raise the cost of every mistake. That is exactly what defensive engineering is supposed to do.