Take the time to think first about your personal security requirements before running it!
X-Content-Type-Options: nosniff |
Switch off MIME-type guessing in MS IE 8+ |
X-XSS-Protection: 0 |
Cross-Site Scripting Protection for MS IE |
X-DNS-Prefetch-Control: off |
Switch off DNS prefetching |
Strict-Transport-Security: max-age=15768000 ; includeSubDomains |
Enforce use of HTTPS at browser-side, but only sent when application was accessed via HTTPS (see RFC 6797) |
X-Frame-Options: DENY |
Deny use of frames completely to avoid click-jacking (see The X-Frame-Options response header) |