Encyclopedia / Quality
Security headers
Response headers that tell the browser to lock things down.
Strict-Transport-Security forces HTTPS. Content-Security-Policy limits where scripts can load from. X-Content-Type-Options stops the browser guessing file types. Referrer-Policy controls what other sites learn about where visitors came from. You can check a site's headers at securityheaders.com.
Strict-Transport-Security: max-age=63072000; includeSubDomains
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-originRelated terms
Where it shows up in a page load
- Step 7: Response comes back. The response travels back with a status code (200 OK), headers (Content-Type, Cache-Control, security headers) and the HTML body. The edge keeps a copy for the next visitor, as long as the cache rules allow it.
Watch the full request journey →
More in Quality
Speed, accessibility, security and measurement, which every other layer depends on.