Fix guide · Web application · low

Security headers missing

A few short response headers switch off risky browser behaviour: X-Content-Type-Options stops browsers guessing a file's type (which can turn an upload into a script), Referrer-Policy stops full URLs, including tokens in them, leaking to other sites, and Permissions-Policy blocks the camera, microphone and location for anything on your pages that should not use them.

Time to fix

5 minutes

Risk if ignored

Content sniffing, URL leaks, feature abuse

Breaks anything?

Rarely. Allow a feature in Permissions-Policy if your site really uses it

How to fix it

In the server block:

add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
add_header X-XSS-Protection "0" always;

Then: sudo nginx -t && sudo systemctl reload nginx. Note: add_header in a location block replaces the server-level ones, so repeat them there if you use any.

In the VirtualHost or .htaccess (needs mod_headers):

Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
Header always set X-XSS-Protection "0"

Then: sudo systemctl reload apache2

Rules → Transform Rules → Modify Response Header → add four "Set static" headers:

X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()
X-XSS-Protection: 0

One rule can set all four.

In web.config, inside <system.webServer>:

<httpProtocol>
  <customHeaders>
    <add name="X-Content-Type-Options" value="nosniff" />
    <add name="Referrer-Policy" value="strict-origin-when-cross-origin" />
    <add name="Permissions-Policy" value="camera=(), microphone=(), geolocation=()" />
    <add name="X-XSS-Protection" value="0" />
  </customHeaders>
</httpProtocol>

X-XSS-Protection is outdated: modern browsers ignore it and the old filter caused its own bugs, so set it to 0. Your Content-Security-Policy is the real protection against XSS.

Check your fix

Common mistakes

Setting Permissions-Policy to block the camera or location on a page that needs it, like a video call or store locator. Allow it there with camera=(self).
Defining add_header inside a location block on nginx and losing all the server-level headers for those URLs.
Using Referrer-Policy: no-referrer everywhere, which can break analytics and some payment redirects. strict-origin-when-cross-origin is the safe default.