thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

HTTP Security Headers

Response headers that enable browser security features such as HSTS, CSP, frame restrictions and MIME sniffing protection.

Definition

Common headers include Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy and the cross-origin isolation headers (COOP, COEP, CORP). Missing headers are a common security misconfiguration finding.

Example

A scan flags the absence of X-Content-Type-Options: nosniff and a weak Referrer-Policy.

Exam tip

Know each header's purpose; missing headers fall under Security Misconfiguration.

Related terms