Security Headers Documentation
Adding security headers to your .htaccess file can help to secure your website and its data. This article explains how to add the following security headers.
- Content-Security-Policy
- Strict-Transport-Security (HSTS)
- X-Frame-Options
- Cross-site Scripting protection (XSS)
- X-Content-Type-Options
- Referrer Policy
- Feature-Policy
- CORS headers
The examples in this article assume your site is on an Apache server and you are adding headers to your site's .htaccess file. View the following article for an overview of what an .htaccess file is and how to add one to your site.
The Content-Security-Policy header specifies approved sources of content that the browser may load from your website. When you whitelist approved content sources, you thereby help to prevent malicious code from loading on your site. This is a way to help reduce XSS risks.
View the following page for further details:
This example allows any asset to be loaded only from your website.
Header set Content-Security-Policy "default-src 'self'"This example allows any asset to be loaded from your domain over HTTPS on port 443 only.
Header set Content-Security-Policy "default-src https://example.com:443"You can then test if it's active by running the following curl command via SSH:
curl -I https://example.comIf you see the following expression, it means you have been successful.
Content-Security-Policy: default-src https://example.com:443If your website has any assets that load over http, your site will display an SSL warning in the URL bar of your browser to notify the visitor that the connection is not safe.
The following code upgrades all requests to insecure resources automatically. This fixes the SSL warning in your browser.
Header always set Content-Security-Policy "upgrade-insecure-requests;"Strict-Transport-Security headers tell the browser to ONLY interact with the site using HTTPS and never HTTP. View the following pages for further details.
You can enable this in your .htaccess file with the following code:
Header set Strict-Transport-Security "max-age=31536000;includeSubDomains;"You can then test if it's active by running the following curl command via SSH:
curl -I https://example.comIf you see the following expression, it means you have been successful.
Strict-Transport-Security: max-age=31536000;includeSubDomains;This header helps to protect your visitors against clickjacking attacks. Add this header on pages that should not be allowed to render a page within a frame. View the following links for further information:
- https://keycdn.com/blog/x-frame-options
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
This example completely disables the ability to load any page in a frame.
Header always set X-Frame-Options DENYThis example only allows your website to embed an iframe on your pages.
Header always set X-Frame-Options SAMEORIGINYou can then test if it's active by running the following curl command via SSH:
curl -I https://example.comIf you see the following expression, it means you have been successful.
X-Frame-Options: SAMEORIGINThe X-XSS-Protection header helps to protect your visitors against Cross-site Scripting attacks. View the following article for further details:
In this example, the value 1 is used. This enables XSS filtering (usually default in browsers). If a cross-site scripting attack is detected, the browser will sanitize the page (remove the unsafe parts).
Header set X-XSS-Protection "1"In this example, the value 1; mode=block is used. Rather than sanitizing the page, the browser will prevent rendering of the page if an attack is detected.
Header set X-XSS-Protection "1; mode=block"You can then test if it's active by running the following curl command via SSH:
curl -I https://example.comIf you see the following expression, it means you have been successful.
X-XSS-Protection: 1; mode=blockThis header blocks content sniffing that could transform non-executable MIME types into executable MIME types. View the following article for further details:
Header set X-Content-Type-Options nosniffYou can then test if it's active by running the following curl command via SSH:
curl -I https://example.comIf you see the following expression, it means you have been successful.
X-Content-Type-Options: nosniffThis header controls how much referrer information from your site is sent to another server. For example, if a link on your site opens a different website, that website's server records your domain name as the referrer of that link. With this policy, you can control what referrer information is sent to that external server. View the following link for further details.
This example does not send any referrer information.
Header set Referrer-Policy: no-referrerYou can then test if it's active by running the following curl command via SSH:
curl -I https://example.comIf you see the following expression, it means you have been successful.
Referrer-Policy: no-referrerThe Feature-Policy header controls which browser features are allowed on your website. This policy allows the website owner/developer to restrict specific APIs the site can access in the browser. Here are a few examples:
- Change the default autoplay behavior on videos.
- Restrict the site from using a camera or microphone.
- Disable the Geolocation API.
This is important if the site allows third-party content as it helps to control what those third-party apps may attempt to do with the user's browser when someone visits your website. View the following links for further information.
- https://developers.google.com/web/updates/2018/06/feature-policy
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy
This example blocks the Geolocation API in the browser from functioning on your site.
Header set Feature-Policy: "geolocation none"You can then test if it's active by running the following curl command via SSH:
curl -I https://example.comIf you see the following expression, it means you have been successful.
Feature-Policy: geolocation noneView the following links for further information.