Implement security headers correctly

Configure HTTP security headers for web application protection

Preventing XSS, clickjacking, MIME-sniffing in browser security-first deployment

• · Site domain, CSP policy, HSTS max-age preference

• · Header directives (CSP, HSTS, X-Frame-Options, etc.)

• · HTTP server config (nginx, Apache) or header middleware

Web server or framework supports custom header injection

• · Overly restrictive CSP breaking assets
• · HSTS preload max-age too short

• · CSP header syntax
• · HSTS preload + OWASP references