Question 1

What are HTTP Security Headers?

Accepted Answer

HTTP Security Headers are server response directives instructing browsers to activate built-in defenses against Clickjacking, Cross-Site Scripting (XSS), MIME-sniffing, and session hijacking.

Question 2

What is HSTS (HTTP Strict Transport Security)?

Accepted Answer

HSTS enforces browsers to establish connections solely via secure HTTPS, preventing protocol downgrade attacks and man-in-the-middle session interception.

Question 3

What is Content Security Policy (CSP)?

Accepted Answer

CSP is a powerful security layer restricting authorized content sources (scripts, styles, frames), effectively mitigating Cross-Site Scripting (XSS) code injections.

Question 4

What does the X-Frame-Options header do?

Accepted Answer

X-Frame-Options (DENY or SAMEORIGIN) prevents your web pages from being embedded within external iframe elements, defending users against Clickjacking attacks.

HTTP Headers & Redirects