// examples · security · caching · api

HTTP Header Examples

A small, copy-pasteable reference for common HTTP headers. Adapt values to your application and test them before rollout.

// examples for servers and APIs

Security headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Require HTTPS for future visits. Enable only after HTTPS works across every subdomain.

X-Content-Type-Options: nosniff
Prevent browsers from MIME-sniffing a response into another type.

Referrer-Policy: strict-origin-when-cross-origin
Send full referrer URLs within your site; send only the origin cross-site.

Permissions-Policy: geolocation=(), camera=(), microphone=()
Disable browser capabilities that the page does not need.

Content Security Policy

Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'

Start in Content-Security-Policy-Report-Only mode when applying a policy to an existing application. Use the CSP Generator → for a starter value.

Caching static assets

Cache-Control: public, max-age=31536000, immutable
For versioned filenames such as app.8f3a1c.js.

Cache-Control: no-cache
For HTML documents that should be revalidated before reuse.

JSON API response

Content-Type: application/json; charset=utf-8
Cache-Control: no-store
X-Request-ID: 7e0d8f5c-...

Nginx example

add_header X-Content-Type-Options "nosniff" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always; add_header X-Frame-Options "DENY" always;

Header support and interactions vary by browser. Read the relevant specification and test in staging before relying on a security control.