Cybersecurity Foundations·A security baseline you can use

Headers, TLS and secrets

Secure defaults at the transport and browser layers reduce the blast radius.

Beginner 14 min read Lesson 9 of 300 Challenge included

What you will be able to do

Redirect HTTP to HTTPS and send HSTS only after the site is fully HTTPS.
Use a restrictive CSP and report violations.
Rotate secrets and keep the service key server-only.

In plain English

HTTPS protects data in transit. HSTS prevents downgrade. Content Security Policy limits injected script. Cookies need secure flags. Secrets belong in a secret manager, not in Git, client bundles or logs.

headers.httpHTTP

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'; frame-ancestors 'none'
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

Your turn

Add a secure header set

Easy

Write four headers that reduce MIME sniffing, framing and referrer leakage.

HTTP · starter

Content-Type: text/html

Check your understanding before moving on.

Knowledge checkQuestion 1

What does HSTS tell a browser?

Select an answer to continue

Study tools

Make it yours.

Keep a private note for this lesson, then turn the key ideas into flashcards you can revisit.

Sign in to save notes and flashcards.Both are private to your account and stay with your progress.

Finished reading?

Lock in what you just learned.

Mark this lesson complete to save your place and move one step closer to the certificate.

Next: Incident response without panic

Lesson 9 of 300 · 0% of course