Guides
How each header works, and how to send it from your stack.
Reference
- X-Frame-Options ReferenceDENY, SAMEORIGIN, and ALLOW-FROM, with browser support for each, how duplicate values are parsed, the meta tag trap, and why CSP frame-ancestors overrides it.
- CSP frame-ancestors ReferenceThe modern clickjacking defense. Allowed sources, the wildcard gotcha, multiple policies, why it ignores default-src and meta tags, and how it overrides X-Frame-Options.
By stack
- NGINXThe always parameter, inheritance trap, proxy mode, and curl verification. Covers add_header at http, server, and location levels.
- Apachemod_headers Header directive, .htaccess vs virtual host, the always keyword, and the duplicate-header table gotcha when proxying to backends.
- CloudflareManaged Transforms, Response Header Transform Rules (dashboard and API), the Pages _headers file, Workers, and the Next.js on Pages trap that left this site unprotected.
- IISweb.config customHeaders, IIS Manager, AppCmd and PowerShell, ASP.NET Core middleware, and URL Rewrite outbound rules. Covers inherited headers and the duplicate-entry 500 error.
- Next.js + Vercelnext.config headers(), has/missing conditions, proxy.ts (formerly middleware), vercel.json, and the static export and Cloudflare Pages caveats.
- WordPressWhat core already sends on wp-admin, then four ways to cover public pages: wp-config.php, the wp_headers filter, .htaccess, and security plugins (Shield, Really Simple Security Pro, Sucuri).