Restricts sources of scripts, styles, images, and other resources. Primary defense against XSS.

ⓘ Use nonces or hashes instead of 'unsafe-inline'. Start with report-only mode.

Prevents browsers from MIME-sniffing a response away from the declared content-type.

Controls whether the page can be embedded in an iframe. Mitigates clickjacking.

ⓘ Superseded by CSP frame-ancestors, but still needed for older browsers.

Activates browser built-in XSS filter (IE/Chrome legacy). Largely obsolete.

ⓘ Set to '0' to disable — the filter can introduce vulnerabilities. Use CSP instead.

Controls how much referrer information is sent with requests.

Controls access to browser features (camera, mic, geolocation, etc.) per origin.

Isolates the browsing context group from cross-origin documents. Required for SharedArrayBuffer.

Requires all subresources to opt into cross-origin isolation.

Prevents cross-origin reads of the resource. Defense against Spectre-style attacks.

Forces HTTPS connections for the domain and optionally subdomains.

ⓘ Only send over HTTPS. Submit to Chrome's preload list for maximum effect.

Requires Certificate Transparency compliance. Now obsolete (CT is mandatory).

Specifies which origins can read the response cross-origin.

ⓘ Never use '*' with credentialed requests. Validate Origin against an allowlist.

Lists HTTP methods allowed for CORS requests.

Lists request headers allowed in CORS requests.

Whether cookies/auth can be included in CORS requests.

ⓘ Requires explicit origin (not '*'). Enables session-riding attacks if misconfigured.

How long preflight results can be cached (seconds).

Directives for caching mechanisms in both requests and responses.

ⓘ Use 'no-store' for sensitive pages (login, dashboards). Use 'immutable' for versioned assets.

HTTP/1.0 cache control. Use Cache-Control instead.

Clears cookies, storage, and cache for the origin. Useful on logout.

Declares the MIME type and encoding of the response body.

ⓘ Always include charset for text types.

Applied encoding transformations (gzip, br, etc.).

Whether content should be displayed inline or downloaded as an attachment.

ⓘ Use for file downloads to prevent content-sniffing attacks.

Length of the response body in octets.