Skip to content
SelfSec
Join the launch listLaunch list
SelfSec
Vulnerability field guide

Security Headers

Browsers can block injected script, refuse framing, insist on HTTPS and guard cookies, but only when the response asks. Here is what each security header does, what a missing header or a mislabeled response costs, and a configuration that holds.

2 articles 15 min total Overview to advanced techniques

Start with the overview

Security Headers8 min read

HTTP Security Headers, Explained: The Browser Defenses You Have to Ask For

Browsers can block injected script, refuse framing, insist on HTTPS and guard cookies, but only when the response asks. Here is what each security header does, what a missing header or a mislabeled response costs, and a configuration that holds.

Read the overview

Security Headers techniques

1 focused deep-dive
  1. 02 Password AutocompletePassword Autocomplete: What the Browser Remembers and How to Mark Password Fields 7 min