Which HTTP security headers does OWASP recommend and how to implement them?

Decloak is an AI-powered web security intelligence platform that scans a site's HTTP/TLS posture, JavaScript, and third-party scripts to produce a report anyone can read. This guide is part of Decloak's library of practical, source-backed security guidance.

Key takeaways

• OWASP lists 15+ headers that harden browsers against XSS, click - jacking, data leakage and protocol downgrade.
• The most critical headers are Strict - Transport - Security, Content - Security - Policy, X - Frame - Options, X - Content - Type - Options, and Referrer - Policy.
• Adding the headers is a one - line configuration change for Apache, Nginx, Express, or similar servers.
• Decloak’s free scan checks the HTTP/TLS security posture layer, which validates that these headers are present and correctly configured.

What are the OWASP - recommended HTTP security headers?

The OWASP Secure Headers project defines a concrete list of response headers that browsers should see to improve security. Each header has a purpose and a recommended configuration value.

How to add the headers in common web servers

Apache (httpd.conf or .htaccess)

# HSTS
Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
# X-Frame-Options
Header always set X-Frame-Options "DENY"
# X-Content-Type-Options
Header always set X-Content-Type-Options "nosniff"
# Referrer-Policy
Header always set Referrer-Policy "strict-origin-when-cross-origin"
# Permissions-Policy (example)
Header always set Permissions-Policy "geolocation=(), camera=(), microphone=()"
# Remove server banner
ServerSignature Off
Header unset Server
Header unset X-Powered-By

Restart Apache after editing.

Nginx (nginx.conf or site - specific block)

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(), camera=(), microphone=()" always;
# Hide server version
server_tokens off;

Reload Nginx with nginx -s reload.

Express (Node.js) using helmet middleware

const helmet = require('helmet');
app.use(helmet({
 hsts: { maxAge: 63072000, includeSubDomains: true, preload: true },
 frameguard: { action: 'deny' },
 xssFilter: false, // disable legacy filter
 hidePoweredBy: true,
 noSniff: true,
 referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
 permissionsPolicy: { features: { geolocation: [], camera: [], microphone: [] } }
}));
// Set cookie security attributes
app.use((req, res, next) => {
 res.cookie('session', token, { httpOnly: true, secure: true, sameSite: 'strict' });
 next();
});

Helmet adds most headers automatically; you can customize each option as shown.

How to verify the headers are present

1. Use a browser developer console: open the Network tab, reload the page, and inspect the response headers.
2. Run a command - line curl request:

curl -I https://example.com | grep -i "strict-transport-security\|content-security-policy\|x-frame-options"

1. Run Decloak’s free scan on the URL. The HTTP/TLS security posture layer will report missing or mis - configured headers and give a grade.

Common pitfalls and how to avoid them

• Setting HSTS on HTTP sites - HSTS only works over HTTPS; ensure the site redirects to HTTPS before adding the header.
• Overly permissive CSP - Start with default-src 'self' and add sources only as needed; a broken CSP will break page functionality.
• Conflicting headers - Some browsers treat X-Frame-Options and Content-Security-Policy: frame-ancestors as mutually exclusive; use only one mechanism.
• Forgetting subdomains - Include includeSubDomains in HSTS and replicate the same header set on every subdomain.
• Dynamic cookie attributes - If you set cookies in code, always include Secure; HttpOnly; SameSite attributes; otherwise the Set - Cookie header may be missing security flags.

When to use additional headers

• COOP and COEP are valuable for sites that embed cross - origin iframes or use SharedArrayBuffer. Add them when you need strong isolation between browsing contexts.
• CORP complements COEP for resources that cannot set crossorigin attributes.
• X-Robots-Tag is useful for API endpoints or private PDFs you do not want indexed.

Summary

OWASP provides a clear, vetted checklist of HTTP response headers that defend against a range of web - based attacks. Implementing the recommended values is a matter of a few configuration lines per server type, and you can verify the result instantly with curl or Decloak’s free scan. Regularly re - run the scan after any deployment change to keep your header set in sync with the live site.