implement-http-security-headers

# implement-http-security-headers Apply headers at the response layer that owns each route and content type. ## When to use - Use for production web applications, static sites, APIs serving browsers, and embedded content. - Do not copy a generic header set without testing required integrations and route behavior. ## Procedure 1. Inventory origins, routes, content types, frames, scripts, styles, media, downloads, cross-origin calls, and browser capabilities. 2. Define threats and compatibility needs for transport, framing, MIME handling, referrers, permissions, isolation, and cross-origin resources. 3. Configure HSTS only after HTTPS coverage, subdomain ownership, redirects, certificate operations, and recovery are proven. 4. Set content-type, frame, referrer, permissions, and cross-origin policies at the narrowest correct scope. 5. Coordinate framing rules with Content Security Policy and explicitly authorized embedders. 6. Stage report-only or monitoring where available and classify violations by route, browser, dependency, and user impact. 7. Test authenticated, anonymous, download, error, redirect, API, embed, and legacy-browser responses. 8. Roll out by environment and route, monitor, document exceptions with expiry, and verify at the public edge. ## Done - A security-header control matrix records threat, route, value, owner, exception, browser support, rollout, and recovery - Automated response, browser journey, embed, download, edge, and regression tests verify enforced headers without breaking required behavior