Welcome to the documentation for Secure Headers, a flexible Python library for managing HTTP security headers. This guide will help you get started with configuring headers, integrating with various web frameworks, and understanding how each security header works.

• Getting Started
• Supported Frameworks
• Security Headers
• Additional Resources
• Migration Notes
• Contributing

To quickly get started using Secure Headers, check out the basic configuration guide in the main README:

• Quick Start Guide

For installation instructions, see the Installation section.

For usage examples, see the Usage Guide.

For detailed configuration options, see the Configuration Guide.

Secure Headers is compatible with many popular Python web frameworks. Below are the integration guides for each supported framework, consolidated in the Frameworks Integration Guide:

If your framework is not listed here, Secure Headers can likely still be integrated. Refer to the Custom Framework Integration Guide for general integration tips.

Secure Headers supports many critical HTTP security headers. Below is a list of headers you can configure, along with detailed documentation for each:

• Cache-Control
  Configure caching behavior to protect sensitive content.

• Content-Security-Policy
  Prevent XSS and data injection attacks by controlling allowed content sources.

• Cross-Origin-Embedder-Policy
  Enhance cross-origin security by specifying cross-origin resource policies.

• Cross-Origin-Opener-Policy
  Prevent attackers from accessing your global objects via cross-origin documents.

• Cross-Origin-Resource-Policy
  Declare which origins can load your resources to prevent unintended data leaks.

• Custom Headers
  Define and manage custom HTTP headers for advanced configurations.

• Permissions-Policy
  Control access to browser features such as geolocation, camera, and microphone.

• Referrer-Policy
  Manage how much referrer information is shared during navigation.

• Server
  Hide or customize the Server header to prevent exposing your server details.

• Strict-Transport-Security (HSTS)
  Ensure that communication is only over HTTPS by enforcing strict transport security.

• X-Content-Type-Options
  Prevent MIME-sniffing attacks by ensuring the browser follows the declared Content-Type.

• X-Frame-Options
  Protect against clickjacking by controlling whether your content can be framed.

• X-DNS-Prefetch-Control
  Control DNS prefetching to avoid leaking outbound link information.

• X-Permitted-Cross-Domain-Policies
  Limit legacy cross-domain policy files for Flash/Silverlight compatibility.

• MDN Web Docs - HTTP Headers
  Explore more about HTTP headers and their use cases.

• OWASP Secure Headers Project
  Learn about security best practices for HTTP headers from OWASP.

• Mozilla Observatory
  A security tool to check the implementation of security headers on your site.

• Security Headers by Scott Helme
  A free tool to test your site for missing security headers.

• HSTS Preload List
  Learn about adding your domain to the HTTP Strict Transport Security (HSTS) preload list.

• CSP Evaluator by Google
  A tool for analyzing Content Security Policies to ensure strong security practices.

We welcome contributions! If you'd like to contribute or have any feedback, feel free to:

• Open an Issue: Report bugs or request features.
• Submit a Pull Request: Contribute code or documentation improvements.
• Contact Us: Reach out via GitHub.