# Overview (/en/docs/web-security/security-headers) Security headers are HTTP response headers that tell the browser how to protect the page and the people using it. Your server sends them with each response, and the browser does the enforcing: blocking injected scripts, refusing plain HTTP, keeping the session cookie away from other sites. Most of them take one line of server configuration. This page is the full list, with each header's status, what it protects against, and the action to take, linking to the page that covers it in depth. The natural first step is to run your own site through the [security headers scanner](/tools/security-headers) and see which of these you already send. ## The security headers at a glance [#the-security-headers-at-a-glance] | Header | Status | Protects against | Action | | ------------------------------------------------------------------------------------------------------------- | --------------- | ------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | | [`Content-Security-Policy`](/en/docs/web-security/policies/content-security-policy) | ✅ Good | XSS, injection, exfiltration | Deploy via [report-only](/en/docs/web-security/policies/content-security-policy/report-only) first | | [`Strict-Transport-Security`](/en/docs/web-security/security-headers/strict-transport-security) | ✅ Good | SSL stripping, cleartext hops | `max-age=63072000; includeSubDomains` | | [`Set-Cookie` attributes](/en/docs/web-security/security-headers/cookie-security) | ✅ Good | Session theft, CSRF | `__Host-` + `Secure` + `HttpOnly` + `SameSite` | | [`X-Content-Type-Options`](/en/docs/web-security/security-headers/x-content-type-options) | ✅ Good | MIME-sniffing XSS | `nosniff` on every response | | [`Referrer-Policy`](/en/docs/web-security/security-headers/referrer-policy) | ✅ Good | URL leaks to third parties | `strict-origin-when-cross-origin` | | [`Cache-Control`](/en/docs/web-security/security-headers/cache-control) | ✅ Good | Cached sensitive pages | `no-store` on personal data | | [`Cross-Origin-Resource-Policy`](/en/docs/web-security/security-headers/cross-origin-resource-policy) | ✅ Good | Spectre-class leaks, hotlinking | `same-site` | | [`Cross-Origin-Opener-Policy`](/en/docs/web-security/policies/cross-origin-opener-policy) | ✅ Good | Window takeover, XS-Leaks | `same-origin` | | [`Cross-Origin-Embedder-Policy`](/en/docs/web-security/policies/cross-origin-embedder-policy) | ✅ Good | Cross-origin data in your process | `require-corp` for isolation | | [`Permissions-Policy`](/en/docs/web-security/policies/permissions-policy) | 🧪 Experimental | Unwanted camera, mic, geolocation use | Deny unused features | | [`X-Frame-Options`](/en/docs/web-security/security-headers/x-frame-options) | ✅ Good | Clickjacking in old browsers | `DENY` alongside [`frame-ancestors`](/en/docs/web-security/policies/content-security-policy/directives/frame-ancestors) | | [`Server`, `X-Powered-By` and friends](/en/docs/web-security/security-headers/information-disclosure-headers) | ❌ Risky | They leak your stack | Remove them | | [`X-XSS-Protection`](/en/docs/web-security/policies/legacy-headers) | ⚠️ Deprecated | Nothing (its filter caused XSS) | Remove; use CSP | | [`Feature-Policy`](/en/docs/web-security/policies/legacy-headers) | ⚠️ Deprecated | Replaced by Permissions-Policy | Migrate | | [`Public-Key-Pins` / `Expect-CT`](/en/docs/web-security/security-headers/deprecated-headers) | ⚠️ Deprecated | Dead TLS experiments | Remove | ## How to read the table [#how-to-read-the-table] * **Good** means fine to ship in production; the Action column is the value to send. * **Risky** means the header itself is the problem; sending it weakens your position, so the action is to remove it. * **Experimental** means not fully standardized or limited to some browsers; the Permissions-Policy header is Chromium-only, though other browsers ignore it harmlessly. * **Deprecated** means browsers removed or replaced it; the row names what to do instead. Each header has exactly one page, and the row links there wherever it lives. Content Security Policy and the other report-emitting policies are documented in the [Policies section](/en/docs/web-security/policies), the delivery of their reports in the [Reporting API section](/en/docs/web-security/reporting-api), and the rest in this section. ## Where to start [#where-to-start] For a site that sends none of these, this order pays off fastest: 1. Scan the site with the [security headers scanner](/tools/security-headers) to see what you send today. 2. Ship the one-liners: [Strict-Transport-Security](/en/docs/web-security/security-headers/strict-transport-security), [X-Content-Type-Options](/en/docs/web-security/security-headers/x-content-type-options), and [Referrer-Policy](/en/docs/web-security/security-headers/referrer-policy). 3. Harden the session cookie with the [Set-Cookie attributes](/en/docs/web-security/security-headers/cookie-security), starting from `__Host-` plus `Secure`, `HttpOnly`, and `SameSite`. 4. Deploy a [Content Security Policy](/en/docs/web-security/policies/content-security-policy/introduction/what-is-csp) in report-only mode and tighten it from the reports before enforcing. 5. Add the cross-origin pair, [Cross-Origin-Opener-Policy](/en/docs/web-security/policies/cross-origin-opener-policy) and [Cross-Origin-Embedder-Policy](/en/docs/web-security/policies/cross-origin-embedder-policy). 6. Remove what the table marks Risky or Deprecated: the [disclosure banners](/en/docs/web-security/security-headers/information-disclosure-headers) and the [dead TLS headers](/en/docs/web-security/security-headers/deprecated-headers). ## See also [#see-also] * [Browser security policies overview](/en/docs/web-security/policies), the report-emitting policies the table links out to * [Reporting API overview](/en/docs/web-security/reporting-api), how the policies deliver their violation reports * [Security headers scanner](/tools/security-headers) to check what your site sends * [How to improve your security headers grade](/en/blog/improve-security-headers-grade), the fix list for a low scan grade