owasp/www-project-secure-headers

The OWASP Secure Headers Project is a free resource that helps people understand and configure HTTP security headers, the invisible instructions a web server sends to a browser to help protect a website and its visitors from attacks. Think of it as a reference guide and toolkit for locking down the "envelope" that carries your web pages to users. The project has three main parts. The first is the main site, which explains what each security header does, why it matters, and how to set it up. The second is a validator: a test suite that checks whether a website's security headers match the project's recommendations. The third is a statistics component that tracks how widely these headers are actually used across the web, giving you a sense of adoption trends. A web developer building a new app, a security engineer auditing an existing site, or a founder wanting to make sure their product isn't missing basic browser-level protections would all find this useful. For example, if you're launching an e-commerce site and want to prevent certain types of clickjacking or cross-site scripting, you'd consult the project to see which headers to enable and then run the validator to confirm your configuration is correct. The repository also uses automated workflows to keep its content fresh, generating data files, validating external links, and monitoring references. Notably, the team is transparent that while they use generative AI as a research and editing assistant, every technical description and recommendation published on the site is written and vetted by a human. The content is free to use under the Apache 2.0 license.