Web servers enforce request limits (content length, request length, URL length), restrict the type and size of accepted headers, and set connection and header timeouts and minimum response rates to blunt slow HTTP attacks. Failed login attempts are limited to defeat brute force. Directory listings are not shown. Cookies carry the Secure flag so they travel only over encrypted channels and the HttpOnly flag so client scripts cannot read them. Responses carry the headers in Annex 5: no platform or version disclosure, HTTP Strict Transport Security with a cache age of at least six months, X-Content-Type-Options nosniff, X-XSS-Protection in block mode, X-Frame-Options SAMEORIGIN, Content-Security-Policy, Referrer-Policy, Feature-Policy and HTTP Public Key Pinning. A robots.txt file in the site root directs crawlers. Where a content management system is used, the default administration folder name is changed.
This control maps to 1 controls across 1 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 1 it maps to, and the evidence behind each claim, over MCP and REST.