HTTP Security Headers

Strict-Transport-Security (HSTS)

Forces HTTPS connections for a specified period, preventing protocol downgrade and MITM attacks.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

• Set max-age to at least one year (31536000 seconds)
• Include includeSubDomains to protect all subdomains
• Add preload only after verifying all subdomains support HTTPS, then submit to the HSTS preload list

X-Frame-Options

Controls whether a page can be rendered in a frame or iframe, mitigating clickjacking.