Skip to main content

HTTP Security Headers

Modern browsers expect specific security headers to protect your users. Charon automatically adds industry-standard headers including Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, and X-Content-Type-Options.

Overview​

HTTP security headers instruct browsers how to handle your content securely. Without them, your site remains vulnerable to clickjacking, XSS attacks, protocol downgrades, and MIME-type confusion. Charon provides a visual interface for configuring these headers without memorizing complex syntax.

Supported Headers​

HeaderPurpose
HSTSForces HTTPS connections, prevents downgrade attacks
Content-Security-PolicyControls resource loading, mitigates XSS
X-Frame-OptionsPrevents clickjacking via iframe embedding
X-Content-Type-OptionsStops MIME-type sniffing attacks
Referrer-PolicyControls referrer information leakage
Permissions-PolicyRestricts browser feature access (camera, mic, geolocation)
Cross-Origin-Opener-PolicyIsolates browsing context
Cross-Origin-Resource-PolicyControls cross-origin resource sharing

Why Use This​

  • Browser Protection: Modern browsers actively check for security headers
  • Compliance: Many security audits and standards require specific headers
  • Defense in Depth: Headers add protection even if application code has vulnerabilities
  • No Code Changes: Protect legacy applications without modifying source code

Security Presets​

Charon offers three ready-to-use presets based on your security requirements:

Basic (Production Safe)​

Balanced security suitable for most production sites. Enables essential protections without breaking typical web functionality.

  • HSTS enabled (1 year, includeSubdomains)
  • X-Frame-Options: SAMEORIGIN
  • X-Content-Type-Options: nosniff
  • Referrer-Policy: strict-origin-when-cross-origin

Strict (High Security)​

Enhanced security for applications handling sensitive data. May require CSP tuning for inline scripts.

  • All Basic headers plus:
  • Content-Security-Policy with restrictive defaults
  • Permissions-Policy denying sensitive features
  • X-Frame-Options: DENY

Paranoid (Maximum)​

Maximum security for high-value targets. Expect to customize CSP directives for your specific application.

  • All Strict headers plus:
  • CSP with nonce-based script execution
  • Cross-Origin policies fully restricted
  • All permissions denied by default

Configuration​

Using Presets​

  1. Navigate to Hosts → Select your host → Security Headers
  2. Choose a preset from the dropdown
  3. Review the applied headers in the preview
  4. Click Save to apply

Custom Header Profiles​

Create reusable header configurations:

  1. Go to Settings → Security Profiles
  2. Click Create Profile
  3. Name your profile (e.g., "API Servers", "Public Sites")
  4. Configure individual headers
  5. Save and apply to multiple hosts

Interactive CSP Builder​

The CSP Builder provides a visual interface for constructing Content-Security-Policy:

  1. Select directive (script-src, style-src, img-src, etc.)
  2. Add allowed sources (self, specific domains, unsafe-inline)
  3. Preview the generated policy
  4. Test against your site before applying

Security Score Calculator​

Each host displays a security score from 0-100 based on enabled headers:

Score RangeRatingDescription
90-100ExcellentAll recommended headers configured
70-89GoodCore protections in place
50-69FairBasic headers only
0-49PoorMissing critical headers

When to Use Each Preset​

ScenarioRecommended Preset
Marketing sites, blogsBasic
E-commerce, user accountsStrict
Banking, healthcare, governmentParanoid
Internal toolsBasic or Strict
APIs (no browser UI)Minimal or disabled