What it is
Checks the response headers that harden a site against browser-side attacks. HSTS forces HTTPS. Content-Security-Policy restricts where scripts, styles and other resources may load from, and is the main defence against cross-site scripting. X-Content-Type-Options stops browsers second-guessing a declared content type. X-Frame-Options controls whether the page can be embedded in a frame, which is what prevents clickjacking.
Why it matters
These cost nothing to add and are very often simply absent. A site missing all of them is not necessarily exploitable, but it has opted out of several protections the browser would otherwise enforce on its behalf. Being present is not enough either, since a CSP that allows inline scripts stops very little.
Key terms
- Clickjacking
- Loading a site in a hidden frame on another page, so visitors click its buttons without realising.
- Content-Security-Policy
- Lists where a page may load scripts and other files from, which blocks most cross-site scripting.
- X-Frame-Options
- Stops other sites showing this page in a frame, which blocks clickjacking.
- Referrer-Policy
- Controls how much of the current URL is shared with other sites when visitors follow links or load files.
- Permissions-Policy
- Turns off browser features like the camera, microphone and location for the page and anything it embeds.
- Cross-Origin-Embedder-Policy
- Only lets the page load files from other sites that allow it, which unlocks features that need Spectre protection.
- X-XSS-Protection
- An old browser filter for cross-site scripting, since removed from browsers. It should now be set to 0.