HTTP headers for the responsible developer
summary
Headers earn concrete wins: Strict-Transport-Security eliminates repeated HTTP roundtrips and enforces HTTPS; Content-Security-Policy works in report-only first to stop injected crypto miners (only ~6% of three million crawled pages use CSP); Brotli beats gzip and Wikipedia saved 9 KB of JS yielding ~1.4 TB saved; cache-control immutable reduces revalidation; Accept-CH plus Save-Data enable serving WebP and smaller assets; Feature-Policy and preload headers force permissions and prioritization, and real examples show blocked injections and smaller downloads.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:00Stefans background
- 2:10Global internet statistics
- 7:20Strict Transport Security
- 9:15CSP
- 12:00HTTP Archive
- 15:10Caching
- 22:05Safe Data
- 25:00AMP
related talks
39mHTTP headers for the responsible developer
40mHTTP Headers for the Responsible Developer
23mHTTP headers for the responsible developer
45mHeaders for hackers
46mHeaders for Hackers
31mHTTP Security Headers: A Technology History Through Scar Tissue
26mHTTP Headers - The Simplest Security
30mHeaders for Hackers