Understand what browser headers can enforce
HTTP security headers tell clients how to handle certain content, connections and embedding behaviors. They reduce specific classes of risk when configured correctly, but do not replace input validation, secure sessions, authentication or code review. A header checklist also cannot determine whether application logic is vulnerable.
Analyze the actual response returned from the relevant page. A redirect, HTML response and JSON API response may have different policies; CDNs can add or change headers before they reach the browser.
Content Security Policy and MIME handling
Content-Security-Policy (CSP) restricts permitted script, style, image and connection sources. A policy such as default-src 'self' is a useful conceptual baseline, but a real site may require carefully reviewed allowances for images or other resources. Prefer narrowly scoped directives, avoid unsafe-inline or broad wildcards when feasible, and test in a reporting mode before enforcing a complex policy.
X-Content-Type-Options: nosniff prevents some MIME sniffing behaviors. Configure a correct Content-Type as well; nosniff does not make an incorrectly labeled resource safe by itself.
Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-originThis snippet is illustrative and not a universal CSP for every deployment.
Transport and framing controls
Strict-Transport-Security (HSTS) instructs supporting browsers to prefer HTTPS for the host after a trusted HTTPS response. It is relevant at the public HTTPS boundary, not to an internal HTTP-only loopback leg behind a tunnel. Choose max-age, includeSubDomains and preload deliberately; premature long-lived HSTS can disrupt unprepared subdomains.
Framing protections can be expressed with CSP frame-ancestors and, for older clients, X-Frame-Options. Modern CSP can be more flexible than the older DENY or SAMEORIGIN values. Avoid interpreting header presence alone as proof that clickjacking has been eliminated.
Referrer-Policy governs the amount of referring URL information sent on navigation and fetches. Permissions-Policy restricts selected browser capabilities but is not a replacement for application-level authorization.
Test the response that users receive
Use browser DevTools or an authorized curl request to capture response status and headers. Review the public CDN response and the local origin separately if the architecture includes a proxy. For a Cloudflare Tunnel application, the browser may observe security headers injected at Cloudflare in addition to the headers emitted by Apache.
Paste sanitized headers into the local HTTP Response Header Review utility. Its output is an advisory checklist, not a vulnerability scan; it cannot validate CSP effectiveness or identify all relevant threats. Confirm that tool pages remain usable after policy changes.