Security Policy
Response headers instructing the client to constrain itself — transport security, framing, script sources, sniffing, referrer leakage.
| Header | Providers | Status | |
|---|---|---|---|
| X-Content-Type-Options | 35 | permanent | |
| Strict-Transport-Security | 35 | permanent | regulated |
| X-Frame-Options | 33 | permanent | |
| Content-Security-Policy | 4 | permanent | regulated |
| NEL | 3 | permanent | |
| Expect-CT | 3 | deprecated | |
| Referrer-Policy | 2 | permanent | |
| Public | 1 | obsoleted | |
| Permissions-Policy | — | provisional | regulated |
| Origin-Agent-Cluster | — | permanent | |
| Cross-Origin-Resource-Policy | — | permanent | |
| Cross-Origin-Opener-Policy-Report-Only | — | permanent | |
| Cross-Origin-Opener-Policy | — | permanent | |
| Cross-Origin-Embedder-Policy-Report-Only | — | permanent | |
| Cross-Origin-Embedder-Policy | — | permanent | |
| Content-Security-Policy-Report-Only | — | permanent | |
| Clear-Site-Data | — | permanent | regulated |
| Sec-Fetch-Storage-Access | — | provisional | |
| Sec-Fetch-Site | — | permanent | |
| Sec-Fetch-Mode | — | permanent | |
| Sec-Fetch-Dest | — | permanent | |
| Reporting-Endpoints | — | provisional | |
| Public-Key-Pins-Report-Only | — | permanent | |
| Public-Key-Pins | — | permanent | |
| PICS-Label | — | obsoleted | |
| Sec-Fetch-User | — | permanent |
All categories
Authentication Authorization & Scope Caching Conditional Requests & Concurrency Content Negotiation Representation Metadata Connection & Transport CORS Security Policy Privacy & Consent Rate Limiting & Quota Tracing & Correlation Idempotency & Reliability Versioning & Lifecycle Integrity & Signing Async & Long-Running Cost & Metering Agent & Bot Identity
Work with this as data
Every header here is available over the APIs.io API and to AI agents over MCP. HTTP Headers is not yet its own endpoint on the v1 API. Reach it through catalog search and the tag graph, or the MCP server.