# Security Headers Reference {#security-headers-reference}


Complete list of recommended security headers for production deployments.


## Recommended Headers {#recommended-headers}


```nginx
# Prevent MIME-type sniffing
add_header X-Content-Type-Options "nosniff" always;

# Prevent clickjacking
add_header X-Frame-Options "SAMEORIGIN" always;

# XSS Protection (legacy browsers)
add_header X-XSS-Protection "1; mode=block" always;

# HSTS - force HTTPS
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

# Referrer Policy
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

# Permissions Policy
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

# Content Security Policy
add_header Content-Security-Policy "default-src 'self'; script-src 'self'" always;
```


## Header Reference {#header-reference}


| Header                      | Value                             | Purpose                 |
| --------------------------- | --------------------------------- | ----------------------- |
| `X-Content-Type-Options`    | `nosniff`                         | Prevent MIME sniffing   |
| `X-Frame-Options`           | `SAMEORIGIN`                      | Prevent clickjacking    |
| `X-XSS-Protection`          | `1; mode=block`                   | Legacy XSS filter       |
| `Strict-Transport-Security` | `max-age=63072000`                | Force HTTPS             |
| `Referrer-Policy`           | `strict-origin-when-cross-origin` | Control referrer        |
| `Permissions-Policy`        | `camera=(), microphone=()`        | Restrict features       |
| `Content-Security-Policy`   | (see CSP guide)                   | Control content sources |


## NestJS Helmet {#nestjs-helmet}


```typescript
import helmet from "helmet";
app.use(helmet());
```

Helmet sets most headers automatically.


## Testing {#testing}


Test your headers at:

- [SecurityHeaders.com](https://securityheaders.com)
- [Mozilla Observatory](https://observatory.mozilla.org)


## Related Pages {#related-pages}


- [Content Security Policy](https://sourcey-gauzy.pages.dev/security/content-security-policy/index.md) — CSP details
- [CORS Configuration](https://sourcey-gauzy.pages.dev/security/cors-configuration/index.md) — CORS setup
- [SSL Certificates](https://sourcey-gauzy.pages.dev/devops/ssl-certificate-management/index.md) — SSL/TLS