{
  "slug": "missing-security-headers",
  "url": "https://library.infinity8labs.com/missing-security-headers/",
  "title": "Missing security headers",
  "short": "Security headers",
  "aliases": [
    "HTTP security headers missing",
    "Browser security policy missing",
    "Response header hardening"
  ],
  "summary": "Missing or weak HTTP security headers leave browser protections undefined or permissive. They can increase the impact of cross-site scripting, clickjacking, content-type confusion, information leakage, and insecure transport.",
  "cwe": [
    "CWE-693"
  ],
  "owasp": "A05:2021 Security Misconfiguration",
  "typical_severity": {
    "min": "low",
    "max": "high"
  },
  "updated": "2026-10-15",
  "references": [
    {
      "title": "CWE-693: Protection Mechanism Failure",
      "url": "https://cwe.mitre.org/data/definitions/693.html"
    },
    {
      "title": "OWASP HTTP Headers Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html"
    },
    {
      "title": "OWASP Content Security Policy Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html"
    },
    {
      "title": "OWASP Top 10 A05:2021 Security Misconfiguration",
      "url": "https://owasp.org/Top10/A05_2021-Security_Misconfiguration/"
    },
    {
      "title": "MDN: HTTP headers",
      "url": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers"
    }
  ],
  "sections": [
    "https://library.infinity8labs.com/missing-security-headers/#overview",
    "https://library.infinity8labs.com/missing-security-headers/#impact",
    "https://library.infinity8labs.com/missing-security-headers/#examples",
    "https://library.infinity8labs.com/missing-security-headers/#remediation",
    "https://library.infinity8labs.com/missing-security-headers/#testing",
    "https://library.infinity8labs.com/missing-security-headers/#references"
  ]
}