HTTP security headers in Cybersecurity - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of HTTP security headers?

HTTP security headers help protect websites and users by instructing browsers how to behave securely, such as preventing attacks or data leaks.

intermediate

What does the Content-Security-Policy (CSP) header do?

CSP controls which resources (like scripts or images) a browser is allowed to load, helping to prevent attacks like cross-site scripting (XSS).

beginner

Explain the role of the Strict-Transport-Security (HSTS) header.

HSTS tells browsers to only connect to a website using HTTPS, which keeps data encrypted and safe from eavesdropping.

intermediate

What does the X-Frame-Options header protect against?

It prevents a website from being shown inside a frame or iframe on another site, protecting against clickjacking attacks.

intermediate

Why is the X-Content-Type-Options header important?

It stops browsers from guessing the type of content, which helps prevent some types of attacks by ensuring files are treated as intended.

Which HTTP header forces browsers to use HTTPS connections only?

A Strict-Transport-Security

B Content-Security-Policy

C X-Frame-Options

D X-Content-Type-Options

Strict-Transport-Security (HSTS) tells browsers to only use HTTPS for the site.

What attack does the Content-Security-Policy header mainly help prevent?

A Cross-Site Scripting (XSS)

B SQL Injection

C Phishing

D Denial of Service

CSP restricts which scripts can run, helping to stop XSS attacks.

Which header helps prevent clickjacking by controlling framing?

A X-Content-Type-Options

B Strict-Transport-Security

C X-Frame-Options

D Content-Security-Policy

X-Frame-Options stops a page from being embedded in frames on other sites.

What does the X-Content-Type-Options header do?

A Prevents framing

B Enforces HTTPS

C Blocks scripts from unknown sources

D Prevents MIME type sniffing

It tells browsers not to guess content types, reducing some attack risks.

Which header would you use to specify allowed sources for scripts and images?

A X-Frame-Options

B Content-Security-Policy

C Strict-Transport-Security

D X-Content-Type-Options

Content-Security-Policy defines which sources are allowed for content like scripts and images.

Describe the main HTTP security headers and their roles in protecting a website.

Think about how each header helps stop a specific type of attack or risk.

Explain why using HTTP security headers is important for website security.

Consider the benefits of instructing browsers on safe behavior.