Security Headers
Security Headers 2026: 7 HTTP zaglavlja koja svaki sajt mora imati
2026-07-20 · Shieldome Scout
HTTP security headers su jedna od najlakših a najefikasnijih bezbednosnih mera: dodaju se u konfiguraciju servera u par minuta i štite od čitave klase napada. Evo šta morate imati u 2026.
← Blog
Zašto security headers?
Browser implementira čitav skup bezbednosnih funkcionalnosti - ali ih aktivira samo ako server eksplicitno to zatraži kroz HTTP response zaglavlja. Bez ovih zaglavlja, browser radi u "kompatibilnom" modu koji je ranjiv na poznate napade. Dodavanje security headers-a je besplatno, ne zahteva izmene koda i može neutralisati čitave klase ranjivosti.
1. Content-Security-Policy (CSP)
CSP je najmoćniji security header: govori browseru koje resurse (JavaScript, CSS, slike, fontovi) sme da učita i odakle. Pravilno konfigurisan CSP čini XSS napade praktično nemogućim jer napadačev ubačeni script neće biti autorizovan za izvršavanje.
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-{random}'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; frame-ancestors 'none'
Počnite sa Content-Security-Policy-Report-Only da vidite kršenja bez blokiranja, pa tek onda pređite na pravi CSP.
2. Strict-Transport-Security (HSTS)
Nalaže browseru da uvek koristi HTTPS za vaš domen - čak i ako korisnik kuca http://. Browser cache-uje ovu instrukciju i odbija HTTP konekcije sve dok max-age ne istekne.
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
preload vam omogućava da dodate domen na browser HSTS preload listu - zaštita važi i za potpuno nove posetioce, pre prvog zahteva.
3. X-Frame-Options
Sprečava Clickjacking napade: napadač ne može ubaciti vaš sajt u <iframe> na svom sajtu i prevariti korisnike da klikću na nevidljive elemente.
X-Frame-Options: DENY
CSP direktiva frame-ancestors 'none' je modernija alternativa i ima prednost kada su oba prisutna.
4. X-Content-Type-Options
Sprečava MIME type sniffing: browser ne sme da "pogađa" tip sadržaja ako server kaže da je text/plain, neće ga izvršiti kao JavaScript.
X-Content-Type-Options: nosniff
5. Referrer-Policy
Kontroliše koje informacije se prosleđuju u Referer zaglavlju kada korisnik klikne na eksterni link. Bez ovog zaglavlja, URL vaše admin stranice ili checkout procesa može biti poslan eksternom sajtu.
Referrer-Policy: strict-origin-when-cross-origin
6. Permissions-Policy
Kontroliše pristup moćnim browser API-jima: kamera, mikrofon, geolokacija, payment request. Onemogućite ono što vaša aplikacija ne koristi.
Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()
7. Cross-Origin-* zaglavlja
Tri zaglavlja za finiju kontrolu cross-origin pristupa:
Cross-Origin-Opener-Policy: same-origin - izoluje browser kontekstCross-Origin-Embedder-Policy: require-corp - potrebno za SharedArrayBufferCross-Origin-Resource-Policy: same-origin - ograničava ko može učitati vaše resurse
Proverite ocenu vaših headers-a na securityheaders.com - besplatan alat koji daje ocenu od A+ do F i prikazuje koja zaglavlja nedostaju. Cilj je A+.
Implementacija za popularne servere
Nginx
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
Apache
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
Header always set X-Frame-Options "DENY"
Header always set X-Content-Type-Options "nosniff"
Shieldome Scout proverava prisutnost i ispravnost svih ovih zaglavlja automatski, bez da narušava rad vašeg sajta.
Često postavljana pitanja
Šta su HTTP security headers?
HTTP security headers su response zaglavlja koja instruišu browser kako da se ponaša pri prikazu vašeg sajta. Pružaju besplatnu, serversku zaštitu od XSS-a, clickjackinga, MIME sniffinga i drugih napada, bez ikakvog uticaja na performanse.
Koje bezbednosno zaglavlje je najvažnije?
Content-Security-Policy (CSP) se smatra najmoćnijim bezbednosnim zaglavljem - kontroliše koje resurse browser sme da učita i efikasno blokira XSS napade. Strict-Transport-Security (HSTS) je jednako kritičan jer garantuje da su sve konekcije šifrovane HTTPS protokolom.
Da li security headers utiču na brzinu sajta?
Ne, security headers nemaju merljiv uticaj na performanse. Dodaju svega nekoliko bajtova HTTP response-u ali ne zahtevaju nikakvo dodatno procesiranje. Jedna su od mera sa najboljim odnosom uloženog truda i dobijene zaštite.
Proverite bezbednost vašeg sajta
Profesionalna procena ranjivosti. OWASP Top 10, dark web monitoring, PDF izveštaj za 2-3 radna dana.
Zatražite procenu →
← Blog
Why Security Headers?
The browser implements a whole set of security features - but only activates them if the server explicitly requests it through HTTP response headers. Without these headers, the browser operates in a "compatible" mode vulnerable to known attacks. Adding security headers is free, requires no code changes, and can neutralize entire classes of vulnerabilities.
1. Content-Security-Policy (CSP)
CSP is the most powerful security header: it tells the browser which resources (JavaScript, CSS, images, fonts) it may load and from where. A properly configured CSP makes XSS attacks practically impossible because an attacker's injected script won't be authorized for execution.
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-{random}'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; frame-ancestors 'none'
2. Strict-Transport-Security (HSTS)
Instructs the browser to always use HTTPS for your domain - even if the user types http://. The browser caches this instruction and refuses HTTP connections until the max-age expires.
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
3. X-Frame-Options
Prevents Clickjacking attacks: an attacker cannot embed your site in an <iframe> on their site and trick users into clicking on invisible elements.
X-Frame-Options: DENY
4. X-Content-Type-Options
Prevents MIME type sniffing: the browser must not "guess" content type - if the server says text/plain, it won't execute it as JavaScript.
X-Content-Type-Options: nosniff
5. Referrer-Policy
Controls what information is passed in the Referer header when a user clicks an external link. Without this header, the URL of your admin page or checkout process could be sent to an external site.
Referrer-Policy: strict-origin-when-cross-origin
6. Permissions-Policy
Controls access to powerful browser APIs: camera, microphone, geolocation, payment request. Disable what your application doesn't use.
Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()
7. Cross-Origin-* Headers
Three headers for finer cross-origin access control:
Cross-Origin-Opener-Policy: same-origin - isolates browser contextCross-Origin-Embedder-Policy: require-corp - needed for SharedArrayBufferCross-Origin-Resource-Policy: same-origin - restricts who can load your resources
Check your headers rating at securityheaders.com - a free tool that gives a grade from A+ to F and shows which headers are missing. Target: A+.
Implementation for Popular Servers
Nginx
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
Shieldome Scout checks the presence and correctness of all these headers automatically, without disrupting your site's operation.
Frequently Asked Questions
What are HTTP security headers?
HTTP security headers are response headers that instruct the browser how to behave when handling your site's content. They provide free, server-side protection against XSS, clickjacking, MIME sniffing, and other attacks with no impact on site performance.
Which security header is most important?
Content-Security-Policy (CSP) is considered the most powerful security header - it controls which resources the browser is allowed to load, effectively blocking XSS attacks. However, Strict-Transport-Security (HSTS) is equally critical for ensuring all connections use HTTPS.
Do security headers affect website performance?
No, security headers have no measurable impact on website performance. They add a few bytes to HTTP responses but require no extra computation. They are one of the highest-ROI security measures available.
Check Your Website Security
Professional vulnerability assessment. OWASP Top 10, dark web monitoring, PDF report in 2-3 business days.
Request Assessment →