What are HTTP security headers?

HTTP security headers are response headers a web server sends to instruct the browser how to behave securely. Key ones include Strict-Transport-Security (forces HTTPS), Content-Security-Policy (blocks XSS), X-Frame-Options (prevents clickjacking), X-Content-Type-Options (stops MIME sniffing), Referrer-Policy, and Permissions-Policy.

Which security header is the most important?

Content-Security-Policy (CSP) and Strict-Transport-Security (HSTS) provide the most protection. CSP is the strongest defense against cross-site scripting (XSS), and HSTS prevents protocol-downgrade and SSL-stripping attacks by forcing every connection to use HTTPS.

Why does my site leak its server version?

The Server and X-Powered-By response headers often reveal the exact software and version a site runs (e.g. nginx/1.21.0 or PHP/8.1). Attackers use this to target known vulnerabilities. Best practice is to suppress or genericize these headers.

HTTP安全標頭分析

檢查任何網站的HTTP安全標頭並評級

分析中...

以JSON取得此結果 → GET /api/security-headers?url=github.com  ·  API文件

常見問題

什麼是HTTP安全標頭？

HTTP安全標頭是伺服器發送給瀏覽器、指示其安全行為的回應標頭。關鍵標頭包括Strict-Transport-Security（強制HTTPS）、Content-Security-Policy（阻止XSS）、X-Frame-Options（防止點擊劫持）、X-Content-Type-Options（阻止MIME嗅探）、Referrer-Policy和Permissions-Policy。

哪個安全標頭最重要？

Content-Security-Policy（CSP）和Strict-Transport-Security（HSTS）提供最強的保護。CSP是抵禦跨站腳本（XSS）的最強防禦，HSTS透過強制每次連線都使用HTTPS來防止協定降級和SSL剝離攻擊。

為什麼我的網站會洩漏伺服器版本？

Server和X-Powered-By回應標頭通常會暴露網站執行的確切軟體和版本（例如nginx/1.21.0或PHP/8.1）。攻擊者利用此資訊針對已知漏洞。最佳實務是抑制或泛化這些標頭。