HTTP Security Headers

Complete Guide to Web Security Headers - Protecting Against Common Web Attacks

What are HTTP Security Headers?

HTTP Security Headers are HTTP response headers that provide additional security controls to protect websites against common web vulnerabilities. They instruct browsers and other clients how to handle your website's content and what security policies to enforce.

Security headers protect against:

  • Clickjacking: Attacks that trick users into clicking on hidden elements
  • MIME Sniffing: Attacks that exploit browser content type detection
  • Information Leakage: Unintended disclosure of sensitive information
  • XSS Attacks: Cross-site scripting vulnerabilities
  • Other Web Vulnerabilities: Various client-side attacks

Why Security Headers Matter

Security headers are a fundamental defense layer. They're easy to implement, have no performance impact, and provide significant security benefits. Missing security headers are "low-hanging fruit" that attackers actively look for and exploit.

Why Security Headers are Critical

1. X-Frame-Options Prevents Clickjacking

Clickjacking is an attack where malicious websites embed your site in an iframe and trick users into clicking on hidden elements. X-Frame-Options prevents this by:

  • DENY: Prevents your site from being embedded in any iframe
  • SAMEORIGIN: Allows embedding only from the same origin

Without X-Frame-Options, attackers can embed your login page in a malicious site and trick users into entering credentials.

2. X-Content-Type-Options Prevents MIME Sniffing

MIME sniffing is when browsers guess content types, which can be exploited. X-Content-Type-Options: nosniff:

  • Forces browsers to respect declared content types
  • Prevents MIME type confusion attacks
  • Stops execution of non-executable files as scripts
  • Protects against content type-based attacks

3. Referrer-Policy Controls Information Leakage

Referrer-Policy controls what referrer information is sent with requests:

  • Prevents leaking sensitive URLs in referrer headers
  • Protects user privacy
  • Prevents information disclosure to third parties
  • Reduces attack surface

4. security.txt Enables Responsible Disclosure

The security.txt file (RFC 9116) provides a standard way for security researchers to report vulnerabilities:

  • Lists contact information for security issues
  • Specifies disclosure policies
  • Enables responsible vulnerability reporting
  • Helps prevent public disclosure of vulnerabilities

What Can Go Wrong Without Security Headers?

Clickjacking Attacks

Without X-Frame-Options:

  • Attackers can embed your site in malicious iframes
  • Users can be tricked into clicking hidden elements
  • Login credentials can be stolen
  • Unauthorized actions can be performed

MIME Sniffing Attacks

Without X-Content-Type-Options:

  • Browsers may execute non-executable files as scripts
  • MIME type confusion attacks are possible
  • XSS vulnerabilities can be exploited
  • Content type-based attacks succeed

Information Leakage

Without Referrer-Policy:

  • Sensitive URLs are leaked in referrer headers
  • User privacy is compromised
  • Third parties receive sensitive information
  • Attack surface is increased

How Security Headers Work: Technical Deep Dive

X-Frame-Options

The X-Frame-Options header controls iframe embedding:

Example Headers:
X-Frame-Options: DENY (no embedding)
X-Frame-Options: SAMEORIGIN (same origin only)

X-Content-Type-Options

Prevents MIME type sniffing:

X-Content-Type-Options: nosniff

Referrer-Policy

Controls referrer information:

Common Values:
Referrer-Policy: no-referrer (no referrer)
Referrer-Policy: strict-origin-when-cross-origin (recommended)
Referrer-Policy: same-origin (same origin only)

security.txt

The security.txt file should be at /.well-known/security.txt or /security.txt and contain:

Contact: mailto:security@prismweb.com
Expires: 2025-12-31T23:59:59.000Z
Preferred-Languages: en
Canonical: https://prismweb.com/.well-known/security.txt

Security Headers Best Practices

1. Implement All Recommended Headers

Configure X-Frame-Options, X-Content-Type-Options, and Referrer-Policy on all pages.

2. Use Appropriate X-Frame-Options

Use DENY unless you need iframe embedding, then use SAMEORIGIN.

3. Configure Referrer-Policy

Use "strict-origin-when-cross-origin" for balanced privacy and functionality.

4. Create security.txt File

Create a security.txt file with contact information and disclosure policy.

How PrismWeb Ensures Security Headers Protection

At PrismWeb, we perform comprehensive security headers validation:

  • X-Frame-Options Check: We verify X-Frame-Options is present and properly configured
  • X-Content-Type-Options Verification: We check that nosniff is set
  • Referrer-Policy Validation: We verify Referrer-Policy is configured
  • security.txt Check: We verify security.txt file exists and is properly formatted
  • Header Configuration: We ensure all security headers are correctly set

When you host with PrismWeb, security headers are properly configured, continuously monitored, and maintained. We ensure your website is protected against clickjacking, MIME sniffing, and information leakage. This is one of our 16 comprehensive security checks that most providers skip.