Headers reference
What each header does, why it matters, and the value to set. No fluff.
Injection & XSS
Content-Security-Policy
The strongest defence against cross-site scripting.
Transport
Strict-Transport-Security (HSTS)
Force HTTPS and defeat SSL-stripping.
Injection & XSS
X-Content-Type-Options
Stop MIME-sniffing.
Framing
X-Frame-Options / frame-ancestors
Prevent clickjacking.
Privacy
Referrer-Policy
Don't leak URLs to third parties.
Privacy
Permissions-Policy
Turn off powerful features you don't use.
Isolation
Cross-Origin-Opener-Policy (COOP)
Isolate your browsing context.
Isolation
Cross-Origin-Resource-Policy (CORP)
Control who can embed your resources.
Cookies
Cookie flags
Secure, HttpOnly, SameSite.
Hardening
Information disclosure
Don't advertise your stack.
Best practice
security.txt
Give researchers a way in.