HTTP Headers (6 articles)

X-XSS-Protection Header Missing: What to Do in 2026

The X-XSS-Protection header is deprecated and ignored by every modern browser, so the real fix is…
Learn More

X-Frame-Options Header Missing or Invalid: How to Fix It

Send a valid X-Frame-Options header (use SAMEORIGIN, or DENY if your pages are never framed) and…
Learn More

Strict-Transport-Security (HSTS) Header Missing: How to Fix It

Add a Strict-Transport-Security response header to force every browser onto HTTPS, starting with a short max-age,…
Learn More

Content-Security-Policy Header Missing: How to Add It

The Content-Security-Policy (CSP) HTTP response header tells browsers which sources of scripts, styles, and other content…
Learn More

X-Content-Type-Options Header Missing: How to Fix It

Add a single response header, X-Content-Type-Options: nosniff, so browsers trust your declared MIME types instead of…
Learn More

Referrer-Policy Header Missing: How to Set It Correctly

Add a Referrer-Policy: strict-origin-when-cross-origin response header so your site controls how much URL data browsers leak…
Learn More

Get new blog posts by email: