Security Header Priority SOP
Which header buys the most safety per minute. Ship in this order.
— Ship Content-Security-Policy first: it's the heaviest lift but the only header that meaningfully blunts XSS. Start report-only.
— Ship X-Content-Type-Options: nosniff next: one line, stops MIME-sniffing attacks instantly.
— Ship Referrer-Policy strict-origin-when-cross-origin: cheap, stops leaking full URLs to third parties.
— Ship Permissions-Policy to disable unused features (camera, geolocation, microphone): shrinks attack surface for free.
— Skip X-XSS-Protection: deprecated and can introduce bugs. Skip X-Frame-Options if CSP frame-ancestors is set; don't double up inconsistently.
— Verify: scan with securityheaders.com, confirm each lands before moving on.
Run this on every new site.
Lockdown Ledger
@LockdownLedger
Security Header Priority SOP
Этот пост опубликован в Telegram-канале Lockdown Ledger. Подписаться можно по ссылке: @LockdownLedger.