What these headers do
- Strict-Transport-Security (HSTS) — forces browsers to use HTTPS, preventing downgrade attacks.
- X-Content-Type-Options: nosniff — stops browsers guessing content types (MIME sniffing).
- X-Frame-Options — blocks your site from being embedded in frames (clickjacking defense).
- Referrer-Policy — limits how much referrer information is shared.
- Permissions-Policy — disables powerful browser features you don't use.
- Content-Security-Policy — controls which resources may load (see our CSP Builder).
How to deploy
- Select the headers you want and your server type.
- Paste the config into your server block (Nginx) or
.htaccess/vhost (Apache). - Reload the server and verify the headers are sent.
Only enable HSTS preload once you're certain every subdomain supports HTTPS — it's hard to undo.