Question 1

What is HSTS and why is it important?

Accepted Answer

HTTP Strict Transport Security (HSTS) instructs browsers to always connect to your site over HTTPS and never fall back to HTTP — even if the user types 'http://'. This prevents SSL-stripping attacks. The 'preload' directive gets your domain added to browsers' built-in HSTS preload list for maximum protection.

Question 2

What does Content-Security-Policy (CSP) do?

Accepted Answer

CSP tells the browser which sources of scripts, styles, images, and other resources are trusted. A strict CSP prevents XSS attacks by blocking inline scripts and restricting resource loading to explicitly allowed domains. Start with a report-only mode (Content-Security-Policy-Report-Only) to test before enforcing.

Question 3

What is clickjacking and how does X-Frame-Options prevent it?

Accepted Answer

Clickjacking is an attack where an attacker embeds your site in a hidden iframe and tricks users into clicking elements they don't intend to. X-Frame-Options: DENY prevents any site from embedding your page in an iframe. The modern equivalent is CSP frame-ancestors 'none'.