A header check should confirm Strict-Transport-Security, X-Content-Type-Options, a Content-Security-Policy, Referrer-Policy, clickjacking protection and sensible Cache-Control, and flag headers that reveal server or framework versions. These are cheap to fix, a passive scan finds missing ones in seconds, and each header has a recommended value you can copy into your proxy or framework settings.
Headers and recommended values
OWASP's HTTP headers cheat sheet gives these values.
| Header | Recommended | Notes |
|---|---|---|
| Strict-Transport-Security | max-age=63072000; includeSubDomains; preload | Check preload rules first |
| X-Content-Type-Options | nosniff | Stops type guessing |
| Referrer-Policy | strict-origin-when-cross-origin | Set it explicitly |
| X-Frame-Options | DENY | CSP frame-ancestors preferred |
| Content-Security-Policy | Tailored to your app | No fixed value |
| Cache-Control | no-store for sensitive pages | private for user content |
| Permissions-Policy | Disable unused features | For example camera, microphone |
| Cross-Origin-Opener-Policy | same-origin | Isolation |
Headers to remove
Remove or neutralize Server and X-Powered-By, and the ASP.NET version headers. The cheat sheet also says not to use Expect-CT or Public-Key-Pins, and to turn off the old X-XSS-Protection header instead of relying on it.
Steps
- Run a passive scan, or fetch your key pages with a command line client and read the headers.
- Compare against the table and list gaps per page type, since API responses and HTML pages need different sets.
- Roll out headers in your reverse proxy or framework middleware, one at a time.
- For CSP, start in report-only mode, review reports, then enforce.
- For HSTS, begin with a short max-age and raise it once subdomains are confirmed to support HTTPS.
- Rescan and keep the check in CI so a deploy that drops a header is noticed.
What headers do not do
Headers reduce risk in browsers. They do not fix injection, broken access control or weak authentication. Treat a clean header report as hygiene, not security.
Try it yourself
Find the header findings and compare each to the table above.
Click through it at your own pace, or open it full screen.
Quick check
Is X-XSS-Protection worth setting?
OWASP's cheat sheet says to leave it off or set it to 0, and rely on a proper CSP instead.
Where should I add headers?
At the reverse proxy or in framework middleware, so every response gets them consistently.
Where Safeguard fits
Safeguard offers dependency and SBOM scanning, reachability analysis and policies and gates that can block a pull request, so the libraries behind your app are checked alongside the app itself. You can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
