What are HTTP security headers?

HTTP security headers are response headers a web server sends to instruct the browser how to behave securely. Key ones include Strict-Transport-Security (forces HTTPS), Content-Security-Policy (blocks XSS), X-Frame-Options (prevents clickjacking), X-Content-Type-Options (stops MIME sniffing), Referrer-Policy, and Permissions-Policy.

Which security header is the most important?

Content-Security-Policy (CSP) and Strict-Transport-Security (HSTS) provide the most protection. CSP is the strongest defense against cross-site scripting (XSS), and HSTS prevents protocol-downgrade and SSL-stripping attacks by forcing every connection to use HTTPS.

Why does my site leak its server version?

The Server and X-Powered-By response headers often reveal the exact software and version a site runs (e.g. nginx/1.21.0 or PHP/8.1). Attackers use this to target known vulnerabilities. Best practice is to suppress or genericize these headers.

HTTP安全标头分析

检查任何网站的HTTP安全标头并评级

分析中...

以JSON获取此结果 → GET /api/security-headers?url=github.com  ·  API文档

常见问题

什么是HTTP安全标头？

HTTP安全标头是服务器发送给浏览器、指示其安全行为的响应标头。关键标头包括Strict-Transport-Security（强制HTTPS）、Content-Security-Policy（阻止XSS）、X-Frame-Options（防止点击劫持）、X-Content-Type-Options（阻止MIME嗅探）、Referrer-Policy和Permissions-Policy。

哪个安全标头最重要？

Content-Security-Policy（CSP）和Strict-Transport-Security（HSTS）提供最强的保护。CSP是抵御跨站脚本（XSS）的最强防御，HSTS通过强制每次连接都使用HTTPS来防止协议降级和SSL剥离攻击。

为什么我的网站会泄露服务器版本？

Server和X-Powered-By响应标头通常会暴露网站运行的确切软件和版本（例如nginx/1.21.0或PHP/8.1）。攻击者利用此信息针对已知漏洞。最佳实践是抑制或泛化这些标头。