HTTP headers for the responsible developer
summary
Shows concrete headers and outcomes: sets HSTS preload to force HTTPS (explains why .dev is HTTPS‑only), uses CSP report-only to find and then block unwanted third‑party scripts, cites that only 6% of crawled sites use CSP, compares Brotli level 11 vs gzip level 6 and recommends lowering Brotli level for speed, explains Accept-CH client hints to serve WebP or sized images, and warns to use link preload with no‑push to avoid cache duplication.
AI-written summary · about
chapters (6)
related talks
39mHTTP headers for the responsible developer
40mHTTP Headers for the Responsible Developer
30mHTTP headers for the responsible developer
59mHTTP Security Headers You Need To Have On Your Web Apps
50mEnhancing Application Security: Understanding and Utilizing Browser Security Features
31mHTTP Security Headers: A Technology History Through Scar Tissue
26mHTTP Headers - The Simplest Security
45mHeaders for hackers