HTTPS, security headers, and CSP

A handful of response headers remove entire attack classes. CSP is the strongest and the fiddliest, so roll it out in report-only first.

What this lesson covers

• Enforce HTTPS and enable HSTS
• Set the headers that block framing and sniffing
• Introduce a content security policy incrementally

This lesson sits in Hardening and Supply Chain, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.