Security Headers Beyond the Basics
Beyond the core security headers lies a second tier that hardens more specialized surfaces: which browser features may run, how origins isolate, and how violations get reported. None are mandatory for every site, but each closes a specific gap. Knowing what they do lets you match headers to your actual threat model instead of cargo-culting a list.
What do the advanced headers add?#
| Header | What it controls |
|---|---|
Permissions-Policy | Which browser APIs (camera, mic, geolocation) may be used |
Cross-Origin-Opener-Policy | Window isolation |
Cross-Origin-Embedder-Policy | Requires embedded resources to opt in |
Cross-Origin-Resource-Policy | Who may embed a resource |
Reporting-Endpoints + Report-To | Where to send violation reports |
Clear-Site-Data | Wipe cookies/storage (e.g. on logout) |
Permissions-Policy is the most broadly useful: denying features you never use — camera=(),
microphone=(), geolocation=() — means even injected script cannot invoke them.
How should you prioritize them?#
Layer by need, not by list length:
- Everyone: HSTS, CSP,
X-Content-Type-Options: nosniff,frame-ancestors,Referrer-Policy. - Most sites:
Permissions-Policydenying unused APIs. - When required: COOP/COEP for cross-origin isolation and powerful APIs.
- For telemetry: reporting endpoints to collect CSP and other violations.
These headers extend your baseline into specialized hardening. Start from the core headers guide and the Web Security hub.
Frequently asked questions#
What is the Permissions-Policy header?
Permissions-Policy (formerly Feature-Policy) lets a site declare which browser features and APIs — camera, microphone, geolocation, and others — may be used, and by which origins. Denying features you do not use shrinks the attack surface, so a compromised or injected script cannot silently invoke sensitive capabilities.
Do I need every security header?
No. Start with the core set — HSTS, CSP, X-Content-Type-Options, frame-ancestors, Referrer-Policy — which most sites need. The advanced headers are situational: add Permissions-Policy to lock down APIs, COOP/COEP if you need cross-origin isolation, and reporting headers when you want telemetry. Match headers to your actual needs.