<story><title>HTTP Security Headers – A Complete Guide</title><url>https://nullsweep.com/http-security-headers-a-complete-guide/</url></story><parent_chain></parent_chain><comment><author>deftnerd</author><text>This is a good basic overview of the basic headers, but I suggest spending some time on Scott Helme&amp;#x27;s blog. He runs securityheaders.io, a free service that scans your site, and assigns it a letter grade based on what headers and configurations you&amp;#x27;ve applied.&lt;p&gt;For instance, his explanation of Content Security Policy headers is much more detailed than in the OP&amp;#x27;s link.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;scotthelme.co.uk&amp;#x2F;content-security-policy-an-introduction&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;scotthelme.co.uk&amp;#x2F;content-security-policy-an-introduc...&lt;/a&gt;</text></comment>
<story><title>HTTP Security Headers – A Complete Guide</title><url>https://nullsweep.com/http-security-headers-a-complete-guide/</url></story><parent_chain></parent_chain><comment><author>undecidabot</author><text>Nice list. You might want to consider setting a &amp;quot;Referrer-Policy&amp;quot;[1] for sites with URLs that you&amp;#x27;d prefer not to leak.&lt;p&gt;Also, for &amp;quot;Set-Cookie&amp;quot;, the relatively new &amp;quot;SameSite&amp;quot;[2] directive would be a good addition for most sites.&lt;p&gt;Oh, and for CSP, check Google&amp;#x27;s evaluator out[3].&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;developer.mozilla.org&amp;#x2F;en-US&amp;#x2F;docs&amp;#x2F;Web&amp;#x2F;HTTP&amp;#x2F;Headers&amp;#x2F;Referrer-Policy&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;developer.mozilla.org&amp;#x2F;en-US&amp;#x2F;docs&amp;#x2F;Web&amp;#x2F;HTTP&amp;#x2F;Headers&amp;#x2F;Re...&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.owasp.org&amp;#x2F;index.php&amp;#x2F;SameSite&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.owasp.org&amp;#x2F;index.php&amp;#x2F;SameSite&lt;/a&gt;&lt;p&gt;[3] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;csp-evaluator.withgoogle.com&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;csp-evaluator.withgoogle.com&lt;/a&gt;</text></comment>