HTTP security headers

Backend security Junior Python 3.13+ PostgreSQL 17+ Reviewed By Best Latest Apps

Pick the fix

Which header stops your login page from being framed by another site?

Options
Hint 1 of 1

Which directive is about who embeds you?

Choose an answer, then open Show answer below to check it.

Show answer

Answer: A Content-Security-Policy: frame-ancestors 'self'

Correct. Only your own origin may frame it.

Clickjacking puts your page in an invisible frame on another site. The frame-ancestors directive tells the browser which origins may embed the page, and 'self' allows only yours.

Why not the others?
  • B X-Content-Type-Options: nosniff. Stops MIME sniffing, not framing.
  • C Referrer-Policy: no-referrer. Controls the Referer header.
  • D Access-Control-Allow-Origin: *. That's CORS, and it loosens things.

30-second answer

Strict-Transport-Security forces HTTPS on future visits. Content-Security-Policy limits where scripts, styles and frames load from and blocks inline script. X-Content-Type-Options: nosniff stops browsers guessing content types. frame-ancestors in CSP (or X-Frame-Options) blocks clickjacking. Referrer-Policy limits what URLs leak to other sites. For APIs, set accurate Content-Type and Cache-Control: no-store on sensitive responses.

Practise saying it · 25 s. No recording, just a timer

Default security headers.

Say your answer out loud, then check which of these points you covered:

  • HSTS
  • CSP
  • nosniff
  • frame-ancestors
  • Referrer-Policy, no-store

Deep dive

Roll out CSP with Content-Security-Policy-Report-Only first.

HSTS preload is hard to undo; be sure every subdomain supports HTTPS.

Permissions-Policy disables features like camera or geolocation.

X-XSS-Protection is obsolete; rely on CSP.

Common mistakes

  • A CSP with 'unsafe-inline' that blocks nothing.
  • Caching authenticated responses in shared caches.
  • Copy-pasting headers without testing.

Senior take & follow-ups

List headers with the attack each blocks, and roll CSP out in report-only mode.

Follow-up questions

Think of your answer first, then open the hint.

  1. How do you prevent clickjacking?

    Show hint

    CSP frame-ancestors 'none' or 'self'.

  2. Why no-store on account pages?

    Show hint

    So shared or back-button caches don't keep private data.

Related questions

Suggest a fix if something here is wrong or out of date.