HTTP Header Reference

A running reference for the headers that actually matter day to day — the ones you'll set when hardening a site, the ones you'll fight with in CORS errors, and the caching headers that make the difference between a fast site and a slow one for no visible reason.

Security headers worth having on every site

• Strict-Transport-Security — forces HTTPS for your domain going forward, closing the window for SSL-stripping downgrade attacks. max-age=31536000; includeSubDomains; preload is the strong version.
• Content-Security-Policy — restricts what the browser is allowed to load and execute. Properly configured, it neutralises most XSS even if an injection slips through elsewhere.
• X-Content-Type-Options: nosniff — stops the browser guessing a file's content type and executing something it shouldn't. There's no good reason to leave this off.
• X-Frame-Options — DENY or SAMEORIGIN stops your site being loaded inside someone else's iframe for clickjacking.
• Referrer-Policy — controls how much of your URL leaks to the next site a user clicks through to. strict-origin-when-cross-origin is a sane default.

Caching headers, and why "just cache everything" is wrong

Cache-Control: max-age=31536000, immutable is for assets with a content hash in the filename — safe to cache for a year because a change means a new URL, not an update to the old one. Cache-Control: no-store is for anything sensitive that should never be written to disk. ETag plus conditional requests let the browser ask "has this changed?" and get back a 304 with no body if the answer is no — cheap for the server, invisible to the user, and often forgotten on APIs that could benefit from it just as much as static assets do.

CORS, briefly

Access-Control-Allow-Origin: * is fine for a public read-only API and wrong for almost anything else. Authenticated APIs need an explicit origin list plus Access-Control-Allow-Credentials: true, and any non-simple cross-origin request (POST with JSON, custom headers) triggers a preflight OPTIONS request first — if your API doesn't handle that preflight correctly, the actual request never even gets sent, and the error the browser gives you is not always obvious about why.