HTTPS, security headers, and CSP

A handful of response headers remove entire attack classes. CSP is the strongest and the fiddliest, so roll it out in report-only first.

8m
Intermediate

Video thumbnail for HTTPS, security headers, and CSP

Video by ByteMonk · YouTube

Check your understanding

3 questions. Unlocks when you finish the video.

Overview

What this lesson covers

Enforce HTTPS and enable HSTS
Set the headers that block framing and sniffing
Introduce a content security policy incrementally

This lesson sits in Hardening and Supply Chain, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.

In this lesson you will:

Enforce HTTPS and enable HSTS
Set the headers that block framing and sniffing
Introduce a content security policy incrementally

Resources

OWASP Top 10The official reference for the tools used in this lesson.