Question 1

What are HTTP security headers?

Accepted Answer

HTTP security headers are response headers that instruct the browser to enable security features. Key headers include Content-Security-Policy (CSP), X-Frame-Options, Strict-Transport-Security (HSTS), X-Content-Type-Options, and Referrer-Policy. Missing or misconfigured headers leave sites vulnerable to XSS, clickjacking, and data leaks.

Question 2

What is Content-Security-Policy (CSP)?

Accepted Answer

CSP is an HTTP header that tells the browser which sources are allowed to load scripts, styles, images, and other resources. A strict CSP like default-src 'self' prevents inline scripts and third-party resources, effectively blocking most XSS attacks even if an injection vulnerability exists.

Header Inspector

How to play

Frequently Asked Questions