Browser Security Headers Reference
Security-related HTTP response headers, small example policies, and deployment checks for ordinary websites.
Security-related HTTP response headers, small example policies, and deployment checks for ordinary websites. Each row includes a practical application and a failure to check before using it.
Use it when
- Review response headers before a website launch.
- Roll out a policy while observing compatibility failures.
Watch out for
- Examples are starting points, not a universal policy.
- Headers complement application security; they do not fix vulnerable code.
The data
10 rows
| Header | Example | Purpose | Deployment check |
|---|---|---|---|
| Content-Security-Policy | default-src 'self'; object-src 'none'; base-uri 'self' | Constrain resource loading and script execution. | Inventory third-party resources before enforcing a policy. |
| Content-Security-Policy-Report-Only | default-src 'self' | Collect policy violations without enforcing the policy. | Use reports to find real dependencies, not as protection. |
| Strict-Transport-Security | max-age=31536000 | Tell HTTPS clients to use secure transport for this host. | Enable only when HTTPS works for the entire policy lifetime. |
| X-Content-Type-Options | nosniff | Reduce MIME-type interpretation surprises. | Serve correct Content-Type values for scripts and styles. |
| Referrer-Policy | strict-origin-when-cross-origin | Limit information sent in referrer headers. | Check cross-origin analytics and link requirements. |
| Permissions-Policy | camera=(), microphone=(), geolocation=() | Restrict selected browser capabilities. | Supported directive names differ by browser. |
| Cross-Origin-Opener-Policy | same-origin | Separate browsing context groups across origins. | Test popup-based login and payment flows. |
| Cross-Origin-Embedder-Policy | require-corp | Require embedding permissions for cross-origin resources. | Cross-origin media may stop loading without suitable headers. |
| Cross-Origin-Resource-Policy | same-origin | Restrict who may load a resource in no-cors mode. | Use a broader policy for intentionally public assets. |
| X-Frame-Options | DENY | Block framing in supporting browsers. | Prefer CSP frame-ancestors for a modern framing policy. |
Fields
The shape of this dataset, read from the data itself: every column, its type and a real value. Agents can use this to plan a query without fetching the whole document.
| Section | Field | Type | Example |
|---|---|---|---|
| data | header | string | Content-Security-Policy |
| data | example | string | default-src 'self'; object-src 'none'; base-uri… |
| data | purpose | string | Constrain resource loading and script execution. |
| data | deployment_check | string | Inventory third-party resources before enforcin… |
Fetch the same bytes
The static files contain the same reference rows as the API, with no API rate limit. Live metadata, such as view counts, may differ. Use the API for content negotiation; use the static files for a cacheable snapshot.
curl "https://yjtoon.com/api/dataset/http-security-headers?format=toon"
const res = await fetch( "https://yjtoon.com/static-data/dataset/http-security-headers.toon" ); const toon = await res.text();
Rate limit: 120 requests per minute per IP, no key and no signup. API reference →
Sources and editorial notes
Original editorial reference notes by YJTOON, informed by the linked primary documentation. External specifications retain their own licenses.
Editorial review: . Source documents keep their own licenses.