The Security Headers Cheat Sheet Every Developer Needs

The Security Headers Cheat Sheet: Copy-Paste CSP, HSTS, and More Security headers are one of the fastest wins in web security — five lines of config that eliminate entire classes of attacks. But the syntax is easy to get wrong, the options are confusing, and "secure defaults" depend on your stack. This is the cheat sheet I keep open every time I'm auditing or configuring a new project. Copy-paste configs for: nginx, Apache, Cloudflare Workers, Express.js, Next.js, and raw HTTP responses. Explanations included — so you understand what you're shipping, not just what to ship. Quick Verification First Before configuring anything, check what you currently have: curl -s -I https://yourdomain.com | grep -iE \ "content-security-policy|strict-transport-security|x-frame-options|x-content-type|x-xss-protection|permissions-policy|referrer-policy" No output? You're starting from zero. Let's fix that. The Headers, Explained 1. Content-Security-Policy (CSP) What it does: Tells the browser which sourc