HTTP security headers: a baseline that holds

A config that sends the security headers with every page can still drop them on 4 of the 6 kinds of response this lesson tests: the 404 page, the 500 page and both answers from the downloads folder. Headers are instructions that a browser follows on its user’s behalf, so a response without them is one the browser was never asked to protect.

You will set a baseline of seven headers and say what each one does not stop, audit ten responses for missing, weak and obsolete headers, roll out HSTSHSTS: HTTP Strict Transport Security: a response header that tells a browser to reach a host only over HTTPS for max-age seconds and to refuse certificate errors there without a click-through. Browsers ignore it when it arrives over plain HTTP. in stages, and finish with a test that checks every kind of response, errors and downloads included.

Headers ask the browser to protect its user

A response header such as X-Content-Type-Options: nosniff changes nothing on the server. It is a request to the browser that receives it: treat this response this way, from now on. Follow one visit to a shop that sends the baseline, and watch what each header changes in the browser:

Every protection in the figure happened inside the browser, and the last step is the one to remember. A script, a mobile app’s HTTP client or another server talking to yours reads no header and obeys none, as the lesson on origins showed for requests in general. OWASP’s cheat sheet makes the same point the other way round: most of these headers matter only for responses a browser renders or loads, so a JSON API needs fewer of them than a page. Security headers are one layer, the one that protects your users in their browsers; every check that decides what a request may do still runs on the server.

The baseline: seven headers and what each leaves open

Here is the baseline this lesson uses, with the ASVS 5.0.0 requirement behind each header. What each one leaves open matters as much as what it does, because a header that is set gets trusted:

• Strict-Transport-Security: max-age=31536000; includeSubDomains (3.4.1). The browser reaches the host and its subdomains only over HTTPS for a year, and refuses certificate errors without a click-through. Leaves open: the very first visit, before any header was seen.
• X-Content-Type-Options: nosniff (3.4.4). The browser trusts the declared Content-Type instead of guessingMIME sniffing: A browser guessing a response's type from its bytes instead of trusting its Content-Type. X-Content-Type-Options: nosniff switches it off, so a file declared as text/plain is never run as HTML., and refuses a script or a stylesheet served with the wrong one. Leaves open: a response that really is HTML.
• Referrer-Policy: strict-origin-when-cross-origin (3.4.5). Other sites get only your origin, never the path or the query. It is the browser default too, and OWASP still advises sending it. Leaves open: secrets in your own URLs, which stay in your logs.
• Content-Security-Policy: frame-ancestors 'none'; object-src 'none'; base-uri 'none' (3.4.3, 3.4.6). The page is refused in any frame, loads no plugins and ignores a planted base tag. Leaves open: injected script, which needs script-src, the subject of the CSP lesson.
• Cross-Origin-Opener-Policy: same-origin (3.4.8). The link between the page and windows of other origins that it opens, or that open it, is cut. Leaves open: requests to your server.
• Cross-Origin-Resource-Policy: same-site (3.5.8). The browser refuses to hand the response to another site’s img or script tag. Leaves open: pages of your own site, and clients outside browsers.
• Cache-Control: no-store on personal data (14.3.2). The browser keeps no copy in its cache. Leaves open: caches on your own servers, which 14.2.2 covers.

Two values need care. same-origin for COOP breaks a sign-in or payment pop-up that must keep a handle on your page; same-origin-allow-popups exists for that case. And no single header list fits every response: the audit below asks pages for framing and opener rules, APIs with personal data for no-store, downloads for Content-Disposition: attachment, and everything for HSTS and nosniff. It runs on ten responses:

// auditHeaders(kind, headers) applies this lesson's baseline to one response and returns what is missing, weak,
// obsolete or leaking, each with the ASVS 5.0.0 requirement or the guide behind it. The baseline depends on the kind
// of response: every response gets HSTS and nosniff, a page that renders gets the framing and opener rules, a
// response with personal data gets no-store, and a download is sent as an attachment.

function auditHeaders(kind, raw) {
  const h = Object.fromEntries(Object.entries(raw).map(([k, v]) => [k.toLowerCase(), String(v)]));
  const found = [];
  const add = (type, header, why, ref) => found.push({ type, header, why, ref });

  const hsts = h['strict-transport-security'];
  const maxAge = Number(/max-age=(\d+)/i.exec(hsts ?? '')?.[1] ?? 0);
  if (!hsts) add('missing', 'Strict-Transport-Security', 'not sent', 'ASVS 3.4.1');
  else if (maxAge < 31536000) add('weak', 'Strict-Transport-Security', `max-age ${maxAge} is under a year`, 'ASVS 3.4.1');
  if (h['x-content-type-options'] !== 'nosniff') add('missing', 'X-Content-Type-Options', 'nosniff not set', 'ASVS 3.4.4');

  if (kind === 'page') {
    if (!/frame-ancestors/i.test(h['content-security-policy'] ?? '')) add('missing', 'CSP frame-ancestors', 'any site may frame it', 'ASVS 3.4.6');
    if (!h['cross-origin-opener-policy']) add('missing', 'Cross-Origin-Opener-Policy', 'not sent', 'ASVS 3.4.8');
    if (/unsafe-url|no-referrer-when-downgrade/i.test(h['referrer-policy'] ?? '')) add('weak', 'Referrer-Policy', 'full URLs go to other sites', 'ASVS 3.4.5');
  }
  if (/allow-from/i.test(h['x-frame-options'] ?? '')) add('weak', 'X-Frame-Options', 'ALLOW-FROM is ignored', 'ASVS 3.4.6');
  if (kind === 'private' && !/no-store/i.test(h['cache-control'] ?? '')) add('missing', 'Cache-Control', 'personal data may be cached', 'ASVS 14.3.2');
  if (kind === 'download' && !/^attachment/i.test(h['content-disposition'] ?? '')) add('missing', 'Content-Disposition', 'opens inline, not as a file', 'ASVS 3.2.1');

  if (h['x-xss-protection'] !== undefined && h['x-xss-protection'].trim() !== '0') add('obsolete', 'X-XSS-Protection', 'set 0 or leave it out', 'OWASP');
  if (h['expect-ct'] !== undefined) add('obsolete', 'Expect-CT', 'remove it', 'OWASP');
  if (h['public-key-pins'] !== undefined) add('obsolete', 'Public-Key-Pins', 'remove it', 'OWASP');
  if (/\d/.test(h.server ?? '')) add('leak', 'Server', `names a version: ${h.server}`, 'ASVS 13.4.6');
  if (h['x-powered-by'] !== undefined) add('leak', 'X-Powered-By', `names the stack: ${h['x-powered-by']}`, 'ASVS 13.4.6');
  return found;
}

const BASE = { 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains', 'X-Content-Type-Options': 'nosniff' };
const PAGE = { ...BASE, 'Content-Security-Policy': "frame-ancestors 'none'; object-src 'none'; base-uri 'none'", 'Cross-Origin-Opener-Policy': 'same-origin', 'Referrer-Policy': 'strict-origin-when-cross-origin' };

const responses = [
  ['shop page, as installed', 'page', { Server: 'nginx/1.27.4', 'X-Powered-By': 'Express' }],
  ['shop page, baseline', 'page', PAGE],
  ['login page, old habits', 'page', { ...PAGE, 'Strict-Transport-Security': 'max-age=300', 'X-XSS-Protection': '1; mode=block', 'Expect-CT': 'max-age=86400, enforce' }],
  ['partner page', 'page', { ...BASE, 'X-Frame-Options': 'ALLOW-FROM https://partner.example', 'Cross-Origin-Opener-Policy': 'same-origin' }],
  ['404 page', 'page', {}],
  ['account API, personal data', 'private', { ...BASE, 'Cache-Control': 'max-age=60' }],
  ['account API, fixed', 'private', { ...BASE, 'Cache-Control': 'no-store' }],
  ['product API, public data', 'public', { ...BASE, 'Cache-Control': 'public, max-age=300' }],
  ['invoice download', 'download', { ...BASE, 'Content-Type': 'application/pdf' }],
  ['invoice download, fixed', 'download', { ...BASE, 'Content-Type': 'application/pdf', 'Content-Disposition': 'attachment; filename="invoice-77.pdf"' }],
];

let total = 0;
for (const [name, kind, headers] of responses) {
  const found = auditHeaders(kind, headers);
  total += found.length;
  console.log(`${name} (${kind}): ${found.length ? `${found.length} finding${found.length === 1 ? '' : 's'}` : 'clean'}`);
  for (const f of found) console.log(`  ${f.type.padEnd(9)}${f.header.padEnd(28)}${f.why} (${f.ref})`);
}
console.log(`${total} findings in ${responses.length} responses`);

shop page, as installed (page): 6 findings
  missing  Strict-Transport-Security   not sent (ASVS 3.4.1)
  missing  X-Content-Type-Options      nosniff not set (ASVS 3.4.4)
  missing  CSP frame-ancestors         any site may frame it (ASVS 3.4.6)
  missing  Cross-Origin-Opener-Policy  not sent (ASVS 3.4.8)
  leak     Server                      names a version: nginx/1.27.4 (ASVS 13.4.6)
  leak     X-Powered-By                names the stack: Express (ASVS 13.4.6)
shop page, baseline (page): clean
login page, old habits (page): 3 findings
  weak     Strict-Transport-Security   max-age 300 is under a year (ASVS 3.4.1)
  obsolete X-XSS-Protection            set 0 or leave it out (OWASP)
  obsolete Expect-CT                   remove it (OWASP)
partner page (page): 2 findings
  missing  CSP frame-ancestors         any site may frame it (ASVS 3.4.6)
  weak     X-Frame-Options             ALLOW-FROM is ignored (ASVS 3.4.6)
404 page (page): 4 findings
  missing  Strict-Transport-Security   not sent (ASVS 3.4.1)
  missing  X-Content-Type-Options      nosniff not set (ASVS 3.4.4)
  missing  CSP frame-ancestors         any site may frame it (ASVS 3.4.6)
  missing  Cross-Origin-Opener-Policy  not sent (ASVS 3.4.8)
account API, personal data (private): 1 finding
  missing  Cache-Control               personal data may be cached (ASVS 14.3.2)
account API, fixed (private): clean
product API, public data (public): clean
invoice download (download): 1 finding
  missing  Content-Disposition         opens inline, not as a file (ASVS 3.2.1)
invoice download, fixed (download): clean
17 findings in 10 responses

The page as installed had six findings, four missing headers and two that name the software (nginx 1.27.4 and Express), while the same page with the baseline had none. The 404 page lost everything, which the last section of this lesson explains. The account API was missing only no-store, and the public product API needed none: caching public data is fine. Even version bannersversion banner: A header or a page that names the software and the version a server runs, such as Server: nginx/1.27.4 or X-Powered-By: Express. It saves anyone looking for a known flaw the work of finding out. appear in the audit, because ASVS 13.4.6 asks for them to go.

HSTS is a promise you ramp up, not a switch

HSTS is the header with the longest memory. Once a browser has seen Strict-Transport-Security over HTTPS, it reaches the host only over HTTPS until max-age runs out, and it refuses certificate errors there without offering a way to click through. That memory is the point and the risk. MDN notes that browsers ignore the header over plain HTTP, so the first visit stays exposed until a secure response sets it, and that the only way to switch it off is max-age=0, sent over HTTPS to each browser that remembers. Set a year with includeSubDomains on a domain with one subdomain that still needs plain HTTP, and its users can be locked out of that subdomain for up to a year.

So roll it out the way hstspreload.org describes: check every subdomain first, then raise max-age in stages, each lasting its full value before the next. Walk through them:

The end of the rollout is one year with includeSubDomains, the value ASVS 5.0.0 requirement 3.4.1 asks for on every response. Preloading is a separate decision. The preload listHSTS preload list: A list of domains built into browsers that are reached only over HTTPS, even on the first visit. Joining needs a year of max-age, includeSubDomains and preload, and leaving it reaches users only through browser updates. is built into browsers, so it protects even the first visit, but its maintainers now recommend HSTS and do not recommend preloading: current browsers already upgrade many plain HTTP visits by themselves, and getting off the list reaches users only through browser updates, over months.

Old headers that now do harm or nothing

Some headers that still appear in templates and old answers have outlived their purpose, and one of them can do harm:

The login page with old habits in the audit carried two of them, X-XSS-Protection: 1; mode=block and Expect-CT, next to a five-minute HSTS that someone never raised. Defaults from libraries help but do not finish the job. Helmet, the middleware that Express’s security guide recommends, sends X-XSS-Protection: 0, removes X-Powered-By and sets most of this baseline, yet its default CSP allows 'unsafe-inline' for styles. A default is a starting point for your own policy. Mind the browser support of newer headers as well: MDN’s compatibility data lists Permissions-Policy in Chromium-based browsers only, so it adds a layer there and nothing elsewhere.

Every kind of response needs the headers

The audit’s 404 page had no headers at all, and that is a configuration problem with a precise cause in a common web server. nginx documents two rules of add_header. Without the always parameter, a header is added only to responses with the status 200, 201, 204, 206, 301, 302, 303, 304, 307 or 308, so error pages go without. And a location block with an add_header of its own inherits none of the server block’s, unless add_header_inherit merge (nginx 1.29.3 and later) says otherwise. Here is a config that falls into both, and its fix:

# The weak config the matrix models: the baseline once, at the server level, without "always".
server {
    listen 443 ssl;
    server_name shop.example;
    # The certificate and upstream lines are left out.

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
    add_header X-Content-Type-Options "nosniff";
    add_header Content-Security-Policy "frame-ancestors 'none'; object-src 'none'; base-uri 'none'";
    add_header Referrer-Policy "strict-origin-when-cross-origin";

    location /downloads/ {
        # A header of its own: this block now inherits none of the four above.
        add_header Content-Disposition "attachment";
    }
}

# The fixed config the matrix models: "always" on every line, and the server's lines merged into each location
# (add_header_inherit needs nginx 1.29.3 or later; on older versions repeat the lines in the location block).
server {
    listen 443 ssl;
    server_name shop.example;
    # The certificate and upstream lines are left out.
    add_header_inherit merge;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Content-Security-Policy "frame-ancestors 'none'; object-src 'none'; base-uri 'none'" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    location /downloads/ {
        add_header Content-Disposition "attachment" always;
    }
}

This program models those two rules and tests six kinds of response under each config, the matrix a scanner of the home page never sees:

// A model of two rules from nginx's documentation of add_header, used to test which kinds of response get the
// baseline. 1. Without the parameter "always", a header is added only to responses with the status 200, 201, 204, 206,
// 301, 302, 303, 304, 307 or 308. 2. A location block with add_header lines of its own inherits none from the server
// block, unless add_header_inherit merge (nginx 1.29.3 and later) says otherwise.

const PLAIN_STATUSES = [200, 201, 204, 206, 301, 302, 303, 304, 307, 308];
const BASELINE = ['Strict-Transport-Security', 'X-Content-Type-Options', 'Content-Security-Policy', 'Referrer-Policy'];
const SHORT = { 'Strict-Transport-Security': 'HSTS', 'X-Content-Type-Options': 'nosniff', 'Content-Security-Policy': 'CSP', 'Referrer-Policy': 'Referrer' };

function headersFor(config, location, status) {
  const own = config.locations[location] ?? [];
  let lines = own.length ? own : config.server;
  if (own.length && config.inherit === 'merge') lines = [...config.server, ...own];
  return lines.filter((line) => line.always || PLAIN_STATUSES.includes(status)).map((line) => line.name);
}

const add = (always) => (name) => ({ name, always });
const weak = {
  server: BASELINE.map(add(false)),
  locations: { '/downloads/': [add(false)('Content-Disposition')] },
};
const fixed = {
  inherit: 'merge',
  server: BASELINE.map(add(true)),
  locations: { '/downloads/': [add(true)('Content-Disposition')] },
};

const kinds = [
  ['200 page /', '/', 200],
  ['301 redirect /old-page', '/', 301],
  ['404 not found', '/', 404],
  ['500 error /checkout', '/', 500],
  ['200 /downloads/77.pdf', '/downloads/', 200],
  ['404 /downloads/78.pdf', '/downloads/', 404],
];

// Why a header is missing: the location's own add_header lines, or a status that needs "always".
function reason(config, location, status) {
  const own = config.locations[location] ?? [];
  if (own.length && config.inherit !== 'merge') return 'own add_header in location';
  return `${status} needs always`;
}

const verdict = (config, location, status) => {
  const sent = headersFor(config, location, status);
  const missing = BASELINE.filter((name) => !sent.includes(name));
  const got = `${BASELINE.length - missing.length} of ${BASELINE.length}`;
  return { ok: missing.length === 0, text: missing.length ? `${got}: ${reason(config, location, status)}` : got };
};

console.log(`Baseline: ${BASELINE.map((name) => SHORT[name]).join(', ')}`);
console.log(`${'response'.padEnd(24)}${'weak config'.padEnd(36)}fixed config`);
const gaps = { weak: 0, fixed: 0 };
for (const [label, location, status] of kinds) {
  const a = verdict(weak, location, status);
  const b = verdict(fixed, location, status);
  gaps.weak += !a.ok;
  gaps.fixed += !b.ok;
  console.log(`${label.padEnd(24)}${a.text.padEnd(36)}${b.text}`);
}
console.log(`Matrix test: weak ${gaps.weak ? `FAIL, ${gaps.weak} of ${kinds.length} kinds lack the baseline` : 'pass'}; fixed ${gaps.fixed ? 'FAIL' : 'pass'}`);

Baseline: HSTS, nosniff, CSP, Referrer
response                weak config                         fixed config
200 page /              4 of 4                              4 of 4
301 redirect /old-page  4 of 4                              4 of 4
404 not found           0 of 4: 404 needs always            4 of 4
500 error /checkout     0 of 4: 500 needs always            4 of 4
200 /downloads/77.pdf   0 of 4: own add_header in location  4 of 4
404 /downloads/78.pdf   0 of 4: own add_header in location  4 of 4
Matrix test: weak FAIL, 4 of 6 kinds lack the baseline; fixed pass

Under the weak config the page and the redirect got all four headers, and four kinds got none: the 404 and the 500, because their statuses need always, and both downloads, because the location block added Content-Disposition and so dropped the rest. The fixed config gave every kind all four. Error pages and downloads are exactly the responses someone else can make your users load, so they need the baseline most.

Set the headers in one place, at the edge or in one middleware that wraps every response, and test the matrix: one request per kind of response, against each environment you own, after every deploy.

Practise: headers for three kinds of response

Write the headers of an HTML page, a JSON API with personal data and a download of a user’s file. The sample tests check each kind against the lesson’s baseline, the obsolete headers included:

/**
 * The security headers of one kind of response: 'page' (an HTML page of the app), 'api' (JSON with the signed-in
 * user's data) or 'download' (a file a user uploaded, sent back to them). Any other kind throws.
 */
export function securityHeaders(kind) {
  // Starter: the same single header for every kind.
  return { 'X-Content-Type-Options': 'nosniff' };
}

import { test, assert } from 'mysmartcopilot:test';
import { securityHeaders } from './headers.mjs';

// The lesson's baseline as a check: the names of the rules a response breaks.
function problems(kind, headers) {
  const h = Object.fromEntries(Object.entries(headers).map(([k, v]) => [k.toLowerCase(), String(v)]));
  const out = [];
  const hsts = h['strict-transport-security'] ?? '';
  if (Number(/max-age=(\d+)/.exec(hsts)?.[1] ?? 0) < 31536000 || !/includesubdomains/i.test(hsts)) out.push('hsts');
  if (h['x-content-type-options'] !== 'nosniff') out.push('nosniff');
  if ('x-powered-by' in h || /\d/.test(h.server ?? '')) out.push('version');
  if ((h['x-xss-protection'] ?? '0') !== '0' || 'expect-ct' in h || 'public-key-pins' in h) out.push('obsolete');
  if (kind === 'page') {
    if (!/frame-ancestors\s+'(none|self)'/.test(h['content-security-policy'] ?? '')) out.push('frame-ancestors');
    if (h['cross-origin-opener-policy'] !== 'same-origin') out.push('coop');
    if (!['strict-origin-when-cross-origin', 'strict-origin', 'same-origin', 'no-referrer'].includes(h['referrer-policy'])) out.push('referrer');
  } else {
    if (!/no-store/.test(h['cache-control'] ?? '')) out.push('no-store');
    if (!['same-origin', 'same-site'].includes(h['cross-origin-resource-policy'])) out.push('corp');
  }
  if (kind === 'download' && !/^attachment/.test(h['content-disposition'] ?? '')) out.push('attachment');
  return out;
}

test('a page refuses framing, isolates its window and keeps its URLs to itself', () => {
  assert.deepEqual(problems('page', securityHeaders('page')), []);
});

test('the API is never cached and is loaded only by its own site', () => {
  assert.deepEqual(problems('api', securityHeaders('api')), []);
  assert.ok(!('content-disposition' in Object.fromEntries(Object.keys(securityHeaders('api')).map((k) => [k.toLowerCase(), 1]))), 'an API answer is not a file to save');
});

test('a download is saved as a file and never cached', () => {
  assert.deepEqual(problems('download', securityHeaders('download')), []);
});

test('an unknown kind is an error, not a guess', () => {
  assert.throws(() => securityHeaders('video'));
});

def security_headers(kind):
    """The security headers of one kind of response: 'page' (an HTML page of the app), 'api' (JSON with the
    signed-in user's data) or 'download' (a file a user uploaded, sent back to them). Any other kind raises
    ValueError."""
    # Starter: the same single header for every kind.
    return {"X-Content-Type-Options": "nosniff"}

import re

from headers import security_headers


def problems(kind, headers):
    """The lesson's baseline as a check: the names of the rules a response breaks."""
    h = {k.lower(): str(v) for k, v in headers.items()}
    out = []
    hsts = h.get("strict-transport-security", "")
    age = re.search(r"max-age=(\d+)", hsts)
    if (int(age.group(1)) if age else 0) < 31536000 or "includesubdomains" not in hsts.lower():
        out.append("hsts")
    if h.get("x-content-type-options") != "nosniff":
        out.append("nosniff")
    if "x-powered-by" in h or re.search(r"\d", h.get("server", "")):
        out.append("version")
    if h.get("x-xss-protection", "0") != "0" or "expect-ct" in h or "public-key-pins" in h:
        out.append("obsolete")
    if kind == "page":
        if not re.search(r"frame-ancestors\s+'(none|self)'", h.get("content-security-policy", "")):
            out.append("frame-ancestors")
        if h.get("cross-origin-opener-policy") != "same-origin":
            out.append("coop")
        if h.get("referrer-policy") not in ("strict-origin-when-cross-origin", "strict-origin", "same-origin", "no-referrer"):
            out.append("referrer")
    else:
        if "no-store" not in h.get("cache-control", ""):
            out.append("no-store")
        if h.get("cross-origin-resource-policy") not in ("same-origin", "same-site"):
            out.append("corp")
    if kind == "download" and not h.get("content-disposition", "").startswith("attachment"):
        out.append("attachment")
    return out


def test_a_page_refuses_framing_isolates_its_window_and_keeps_its_urls_to_itself():
    assert problems("page", security_headers("page")) == []


def test_the_api_is_never_cached_and_is_loaded_only_by_its_own_site():
    assert problems("api", security_headers("api")) == []
    assert "content-disposition" not in {k.lower() for k in security_headers("api")}, "an API answer is not a file to save"


def test_a_download_is_saved_as_a_file_and_never_cached():
    assert problems("download", security_headers("download")) == []


def test_an_unknown_kind_is_an_error_not_a_guess():
    try:
        security_headers("video")
    except ValueError:
        return
    raise AssertionError("an unknown kind must raise ValueError")

Then the self-check, one question at a time, picked from the header rules you are least sure of:

Interview questions

Warm-up: what does Strict-Transport-Security do, and what does it not protect?

It tells the browser to reach the host, and with includeSubDomains every subdomain, only over HTTPS for max-age seconds, upgrading http links itself and refusing certificate errors without a click-through. That stops someone on the network from downgrading the user’s later visits to plain HTTP. It does not protect the first visit, because the browser has not seen the header yet and ignores it over HTTP; the preload list closes that gap, at the cost of a slow removal. It does nothing for clients that are not browsers, and nothing about the application itself: an HTTPS page with an XSS hole is still a page with an XSS hole. Roll it out in stages, because a year of max-age cannot be taken back quickly.

Key takeaways

• Security headers are instructions the browser follows for its user; clients outside a browser ignore them, so they add a layer and never replace a server-side check.
• The baseline depends on the kind of response: HSTS and nosniff everywhere, framing and opener rules on pages, no-store on personal data, attachment on downloads, and no version banners.
• HSTS is rolled out from five minutes to a year in stages, each waited out in full, and preloading is a separate decision that is slow to undo.
• X-XSS-Protection other than 0, Expect-CT, Public-Key-Pins and ALLOW-FROM should go, and library defaults such as Helmet’s are a start for your own policy.
• In nginx, headers without always skip error pages and a location with its own add_header drops the rest, so test one response of every kind on every environment.