This directory contains detailed documentation for all 15 security headers analyzed by this tool. Each header has its own dedicated guide covering technical details, attack scenarios, and configuration examples.
| Header | Severity | Complexity | Status |
|---|---|---|---|
| HSTS | Critical | Medium | Active |
| CSP | Critical | Hard | Active |
| X-Frame-Options | High | Easy | Active |
| Referrer-Policy | High | Medium | Active |
| X-Content-Type-Options | Medium | Easy | Active |
| Set-Cookie | Medium | Medium | Active |
| Cache-Control | Medium | Medium | Active |
| Expect-CT | Medium | Easy | Deprecated |
| X-Permitted-Cross-Domain-Policies | Medium | Easy | Legacy |
| X-XSS-Protection | Low | Easy | Deprecated |
| X-Download-Options | Low | Easy | IE Only |
| Permissions-Policy | Low | Hard | Active |
| COEP | Low | Medium | Active |
| COOP | Low | Medium | Active |
| CORP | Low | Medium | Active |
Missing these headers is a critical security issue.
Header: Strict-Transport-Security
File: HSTS.md
Purpose: Forces HTTPS connections to prevent protocol downgrade attacks
Attack Prevented: SSL stripping, man-in-the-middle attacks
Best Practice: max-age=31536000; includeSubDomains; preload
Header: Content-Security-Policy
File: CSP.md
Purpose: Controls which resources can be loaded to prevent XSS attacks
Attack Prevented: Cross-site scripting (XSS), code injection
Best Practice: default-src 'self'; script-src 'self' (strict policy)
Missing these headers is a high-risk security issue.
Header: X-Frame-Options
File: X-Frame-Options.md
Purpose: Prevents page from being embedded in frames to stop clickjacking
Attack Prevented: Clickjacking, UI redressing attacks
Best Practice: DENY or SAMEORIGIN
Header: Referrer-Policy
File: Referrer-Policy.md
Purpose: Controls how much referrer information is sent with requests
Attack Prevented: Information leakage through referrer headers
Best Practice: strict-origin-when-cross-origin or no-referrer
Missing these headers is a medium-risk security issue.
Header: X-Content-Type-Options
File: X-Content-Type-Options.md
Purpose: Prevents MIME type sniffing
Attack Prevented: MIME confusion attacks
Best Practice: nosniff
Header: Set-Cookie
File: Set-Cookie.md
Purpose: Secure cookie attributes (HttpOnly, Secure, SameSite)
Attack Prevented: Session hijacking, CSRF
Best Practice: Include Secure; HttpOnly; SameSite=Strict attributes
Header: Cache-Control
File: Cache-Control.md
Purpose: Controls caching behavior for sensitive content
Attack Prevented: Information disclosure through caches
Best Practice: no-store, no-cache for sensitive pages
Header: Expect-CT
File: Expect-CT.md
Purpose: Enforces Certificate Transparency
Status: enforce, max-age=86400
Header: X-Permitted-Cross-Domain-Policies
File: X-Permitted-Cross-Domain-Policies.md
Purpose: Controls Flash and PDF cross-domain policies
Attack Prevented: Cross-domain data access by Flash/PDFs
Best Practice: none
Missing these headers is a low-risk security issue.
Header: X-XSS-Protection
File: X-XSS-Protection.md
Purpose: Legacy XSS filter control (deprecated)
Status: 0 (disabled) or omit entirely
Header: X-Download-Options
File: X-Download-Options.md
Purpose: Prevents IE from executing downloads in site context
Attack Prevented: Drive-by downloads in IE8+
Best Practice: noopen
Header: Permissions-Policy
File: Permissions-Policy.md
Purpose: Controls browser feature access (camera, geolocation, etc.)
Attack Prevented: Unauthorized feature usage Best Practice: Deny unused features
Header: Cross-Origin-Embedder-Policy
File: COEP.md
Purpose: Controls cross-origin resource embedding
Attack Prevented: Spectre attacks via cross-origin resources
Best Practice: require-corp for isolation
Header: Cross-Origin-Opener-Policy
File: COOP.md
Purpose: Isolates browsing context from cross-origin windows
Attack Prevented: Cross-origin attacks via window references
Best Practice: same-origin for isolation
Header: Cross-Origin-Resource-Policy
File: CORP.md
Purpose: Protects resources from cross-origin reads
Attack Prevented: Spectre attacks, cross-origin data theft
Best Practice: same-origin or same-site
- HSTS - Force HTTPS connections
- CSP - Control resource loading
- X-Content-Type-Options - Prevent MIME sniffing
- X-Frame-Options - Frame embedding control
- Referrer-Policy - Referrer information control
- Set-Cookie - Secure cookie attributes
- Cache-Control - Caching control
- Permissions-Policy - Feature control
- X-XSS-Protection -
⚠️ Deprecated - Expect-CT -
⚠️ Deprecated - X-Download-Options - IE only
- X-Permitted-Cross-Domain-Policies - Flash/PDF
- Quick Reference - Name, purpose, severity
- What It Does - Plain English explanation
- How It Works - Technical details
- Real-World Attack Scenarios - Concrete exploit examples
- Configuration Examples - Good ✅, Acceptable
⚠️ , Bad ❌ - Common Mistakes - Pitfalls and fixes
- Implementation Guide - Framework-specific instructions
- Browser Compatibility - Support table
- Additional Resources - MDN, OWASP, RFCs
Beginners:
- Start with X-Content-Type-Options (simplest)
- Then X-Frame-Options (easy to understand)
- Move to HSTS (more complex)
- Finally CSP (most complex)
Security Engineers:
- Attack Scenarios Guide - Cross-header attacks
- Critical headers: HSTS, CSP
- High priority: X-Frame-Options, Referrer-Policy
- Review all others for comprehensive coverage
Developers:
- Best Practices - Quick configuration guide
- Header docs relevant to your stack
- API Documentation - Programmatic usage
- Attack Scenarios - Real-world attack examples
- Best Practices - Configuration recommendations
- Analyzer Specifications - How we validate each header
- API Reference - Library usage
- Mozilla Observatory - Test your site
- OWASP Secure Headers Project
- MDN Web Docs
- SecurityHeaders.com - Online scanner
Found an issue or want to improve header documentation?
- Check Contributing Guidelines
- Open an issue or pull request
- Follow documentation standards:
- Brevity
- Conciseness
- Accuracy
Last Updated: 2025-12-12 Headers Documented: 15/15 Coverage: Complete