Security Headers 2026: 7 HTTP zaglavlja koja svaki sajt mora imati

← Blog

Zašto security headers?

Browser implementira čitav skup bezbednosnih funkcionalnosti — ali ih aktivira samo ako server eksplicitno to zatraži kroz HTTP response zaglavlja. Bez ovih zaglavlja, browser radi u "kompatibilnom" modu koji je ranjiv na poznate napade. Dodavanje security headers-a je besplatno, ne zahteva izmene koda i može neutralisati čitave klase ranjivosti.

1. Content-Security-Policy (CSP)

CSP je najmoćniji security header: govori browseru koje resurse (JavaScript, CSS, slike, fontovi) sme da učita i odakle. Pravilno konfigurisan CSP čini XSS napade praktično nemogućim jer napadačev ubačeni script neće biti autorizovan za izvršavanje.

Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-{random}'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; frame-ancestors 'none'

Počnite sa Content-Security-Policy-Report-Only da vidite kršenja bez blokiranja, pa tek onda pređite na pravi CSP.

2. Strict-Transport-Security (HSTS)

Nalaže browseru da uvek koristi HTTPS za vaš domen — čak i ako korisnik kuca http://. Browser cache-uje ovu instrukciju i odbija HTTP konekcije sve dok max-age ne istekne.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

preload vam omogućava da dodate domen na browser HSTS preload listu — zaštita važi i za potpuno nove posetioce, pre prvog zahteva.

3. X-Frame-Options

Sprečava Clickjacking napade: napadač ne može ubaciti vaš sajt u <iframe> na svom sajtu i prevariti korisnike da klikću na nevidljive elemente.

X-Frame-Options: DENY

CSP direktiva frame-ancestors 'none' je modernija alternativa i ima prednost kada su oba prisutna.

4. X-Content-Type-Options

Sprečava MIME type sniffing: browser ne sme da "pogađa" tip sadržaja ako server kaže da je text/plain, neće ga izvršiti kao JavaScript.

X-Content-Type-Options: nosniff

5. Referrer-Policy

Kontroliše koje informacije se prosleđuju u Referer zaglavlju kada korisnik klikne na eksterni link. Bez ovog zaglavlja, URL vaše admin stranice ili checkout procesa može biti poslan eksternom sajtu.

Referrer-Policy: strict-origin-when-cross-origin

6. Permissions-Policy

Kontroliše pristup moćnim browser API-jima: kamera, mikrofon, geolokacija, payment request. Onemogućite ono što vaša aplikacija ne koristi.

Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()

7. Cross-Origin-* zaglavlja

Tri zaglavlja za finiju kontrolu cross-origin pristupa:

• Cross-Origin-Opener-Policy: same-origin — izoluje browser kontekst
• Cross-Origin-Embedder-Policy: require-corp — potrebno za SharedArrayBuffer
• Cross-Origin-Resource-Policy: same-origin — ograničava ko može učitati vaše resurse

Implementacija za popularne servere

Nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

Apache

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
Header always set X-Frame-Options "DENY"
Header always set X-Content-Type-Options "nosniff"

Shieldome Scout proverava prisutnost i ispravnost svih ovih zaglavlja automatski, bez da narušava rad vašeg sajta.

← Blog

Why Security Headers?

The browser implements a whole set of security features — but only activates them if the server explicitly requests it through HTTP response headers. Without these headers, the browser operates in a "compatible" mode vulnerable to known attacks. Adding security headers is free, requires no code changes, and can neutralize entire classes of vulnerabilities.

1. Content-Security-Policy (CSP)

CSP is the most powerful security header: it tells the browser which resources (JavaScript, CSS, images, fonts) it may load and from where. A properly configured CSP makes XSS attacks practically impossible because an attacker's injected script won't be authorized for execution.

Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-{random}'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; frame-ancestors 'none'

2. Strict-Transport-Security (HSTS)

Instructs the browser to always use HTTPS for your domain — even if the user types http://. The browser caches this instruction and refuses HTTP connections until the max-age expires.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

3. X-Frame-Options

Prevents Clickjacking attacks: an attacker cannot embed your site in an <iframe> on their site and trick users into clicking on invisible elements.

X-Frame-Options: DENY

4. X-Content-Type-Options

Prevents MIME type sniffing: the browser must not "guess" content type — if the server says text/plain, it won't execute it as JavaScript.

X-Content-Type-Options: nosniff

5. Referrer-Policy

Controls what information is passed in the Referer header when a user clicks an external link. Without this header, the URL of your admin page or checkout process could be sent to an external site.

Referrer-Policy: strict-origin-when-cross-origin

6. Permissions-Policy

Controls access to powerful browser APIs: camera, microphone, geolocation, payment request. Disable what your application doesn't use.

Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()

7. Cross-Origin-* Headers

Three headers for finer cross-origin access control:

• Cross-Origin-Opener-Policy: same-origin — isolates browser context
• Cross-Origin-Embedder-Policy: require-corp — needed for SharedArrayBuffer
• Cross-Origin-Resource-Policy: same-origin — restricts who can load your resources

Implementation for Popular Servers

Nginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

Shieldome Scout checks the presence and correctness of all these headers automatically, without disrupting your site's operation.