<story><title>HTTP Security Headers – A Complete Guide</title><url>https://nullsweep.com/http-security-headers-a-complete-guide/</url></story><parent_chain></parent_chain><comment><author>deftnerd</author><text>This is a good basic overview of the basic headers, but I suggest spending some time on Scott Helme&amp;#x27;s blog. He runs securityheaders.io, a free service that scans your site, and assigns it a letter grade based on what headers and configurations you&amp;#x27;ve applied.&lt;p&gt;For instance, his explanation of Content Security Policy headers is much more detailed than in the OP&amp;#x27;s link.&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;scotthelme.co.uk&amp;#x2F;content-security-policy-an-introduction&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;scotthelme.co.uk&amp;#x2F;content-security-policy-an-introduc...&lt;/a&gt;</text></comment>
<story><title>HTTP Security Headers – A Complete Guide</title><url>https://nullsweep.com/http-security-headers-a-complete-guide/</url></story><parent_chain></parent_chain><comment><author>spectre256</author><text>It&amp;#x27;s definitely worth repeating the warning that, while very useful, Strict-Transport-Security should be deployed with special care!&lt;p&gt;While the author&amp;#x27;s example of `max-age=3600` means there&amp;#x27;s only an hour of potential problems, enabling Strict-Transport-Security has the potential to prevent people from accessing your site if for whatever reason you are no longer able to serve HTTPS traffic.&lt;p&gt;Considering another common setting is to enable HSTS for a year, its worth enabling only deliberately and with some thought.</text></comment>