Controls which resources the browser can load. Mitigates XSS and data injection attacks.

Forces HTTPS connections. Prevents protocol downgrade attacks and cookie hijacking.

Prevents MIME-type sniffing. Reduces drive-by download attacks.

Controls whether the page can be embedded in iframes. Prevents clickjacking.

Legacy XSS filter for older browsers. Modern browsers rely on CSP instead.

Controls how much referrer information is shared with other sites.

Controls browser features like camera, microphone, geolocation.

Isolates browsing context. Prevents Spectre-like side-channel attacks.

Controls which origins can load your resources.

Controls embedding of cross-origin resources. Required for SharedArrayBuffer.