Security header reference | Domain Flock Docs

Directs browsers and proxies on whether and how long to cache a response, important for sensitive pages.

Restricts which sources scripts, styles, and other resources may load from, the primary defence against XSS.

Requires embedded cross-origin resources to explicitly opt in, enabling powerful isolated browsing contexts.

Isolates your browsing context from cross-origin popups, preventing them from referencing your window.

Controls which origins may load your resources, protecting against cross-origin information leaks.

Lets you disable browser features like camera, microphone, or geolocation for your own pages and any embeds.

Controls how much URL information is sent in the Referer header when users click outbound links.

Advertises the web server software and version, which can hand attackers a head start on known exploits.

Forces browsers to only ever connect over HTTPS, closing the door on downgrade and cookie-hijacking attacks.

Stops browsers from guessing ("sniffing") a response's MIME type, closing a class of content-sniffing attacks.

Prevents your pages from being embedded in a frame on another site, blocking clickjacking attacks.

Advertises the application framework or language in use, another unnecessary fingerprinting hint.

A legacy header that toggled browsers' built-in XSS filter. Deprecated: CSP is the modern replacement.