Defense in Depth

Use HTTP Security Headers as Defense in Depth

HTTP security headers let a server tell browsers which security rules should apply to a response. They can restrict where content loads from, prevent MIME type guessing, reduce referrer leakage, and enforce encrypted transport. They are useful defense in depth, not a replacement for input validation, output encoding, authentication controls, or secure session handling. A strong header policy can limit the impact of some mistakes, but it cannot make an unsafe application secure by itself.