What HTTP headers do
Headers are instructions a server sends with every page. They control caching, compression, security rules and how browsers treat your content.
Security headers worth adding
- Strict-Transport-Security: forces HTTPS on return visits
- Content-Security-Policy: limits which scripts can run
- X-Content-Type-Options: nosniff
- X-Frame-Options or frame-ancestors: stops clickjacking
- Referrer-Policy: controls what other sites see about your pages