Why is HSTS preload important?

Preload ensures web browsers only connect via HTTPS on the very first visit, eliminating the insecure HTTP redirect window where attacks occur.

What does X-Content-Type-Options do?

It instructs browsers not to guess MIME types, preventing user-uploaded files (like images) from being interpreted as malicious executable scripts.

TRANSPORT & BROWSER SHIELD

HTTP Security Headers & Hardening Analyzer

Inspect Content Security Policy, HSTS, and clickjacking defenses to protect web clients.

Overview & Threat Landscape

Modern web applications operate in hostile browser environments. Missing HTTP security headers allow cross-site scripting (XSS), clickjacking in invisible iframes, protocol downgrade attacks, and cookie hijacking.

Critical Attack Vectors Mitigated by Headers

XSS & Data Theft (CSP)

A strict Content-Security-Policy forbids execution of injected malicious JavaScript and unauthorized third-party exfiltration.

Clickjacking (X-Frame-Options)

Prevents attackers from embedding your payment or login portal inside hidden iframes to steal user clicks.

MITM Downgrades (HSTS)

Enforces strict HTTPS connections, preventing man-in-the-middle packet interception on public networks.

Recommended Nginx Configuration

Add these hardened response headers to your web server block:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;