Without CSP, an attacker can inject malicious code into your page (XSS attack). They could steal visitor sessions, display fake forms or redirect them to a fraudulent site — without your knowledge.

The browser knows exactly which scripts and resources are allowed on your site. Any injection attempt is automatically blocked, even if a vulnerability exists in your code.

Without HSTS, an attacker can intercept your visitors' connection before HTTPS is established (man-in-the-middle attack). Passwords and sensitive data may travel in plain text without anyone noticing.

The browser is forced to always use HTTPS for this domain (according to max-age). The connection is encrypted from the very first request, with no possible exception.

Your site can be embedded in an invisible frame on another page. An attacker can overlay transparent elements and trick you into clicking unintended actions without your knowledge (clickjacking) — such as confirming a payment or changing a password.

Your site cannot be embedded in an external frame. Clickjacking attempts are neutralised before the visitor even interacts.

Without this header, the browser may guess a file's type and execute malicious code disguised as an image or text document. A file uploaded by a malicious user could be interpreted as JavaScript.

Files are always executed according to their officially declared type. Disguised malicious uploads are neutralised, even if your server-side validation is imperfect.

By default, the full URL of your page is sent to third-party sites when a visitor clicks a link. Potentially sensitive data (URL tokens, IDs, search parameters) can leak to external services such as analytics or CDN.

You precisely control which information is shared. Your internal URL remains private; only the origin (domain) is transmitted if needed.

Without this header, embedded third-party scripts (ads, widgets, trackers) can silently access sensitive features: your visitors' camera, microphone, geolocation or accelerometer — without your explicit authorisation.

You define a whitelist of browser APIs allowed on your site. Even a compromised third-party script cannot access these sensitive features.

A malicious page opened from your site in a new tab can access your page's window object and spy on it (cross-origin leak). This potentially exposes session data or displayed information.

Your page is isolated from other browsing contexts. Even if a user opens a malicious link from your site, the two pages cannot communicate.

Your page can load resources from any external origin without explicit restriction, opening attack vectors related to cross-origin resources.

Only resources whose server explicitly allows embedding can be loaded on your page. Strengthens isolation and protects against side-channels like Spectre.