With the rise of cybersecurity threats, protecting your website and its visitors is of utmost importance. One effective way to bolster your website’s defenses is by implementing security headers. These headers provide instructions to the web browser on how to handle and secure certain aspects of your website. In this comprehensive guide, we will explore various security headers and provide step-by-step instructions on how to use them to enhance your website’s security. By implementing these headers, you can fortify your website against common vulnerabilities and ensure a safer online experience for your users.

What are security headers?

Security headers are directives used by web applications to configure security defenses in web browsers. They can help to protect your website from a variety of attacks, including cross-site scripting (XSS), clickjacking, and man-in-the-middle attacks.

X-XSS-Protection

Cross-Site Scripting (XSS) attacks pose a significant threat to web applications. The X-XSS-Protection header helps mitigate this risk by enabling the built-in XSS protection in modern web browsers. We’ll guide you through the process of adding this header to your website’s response.

Header set X-XSS-Protection "1; mode=block"

Content Security Policy (CSP)

CSP is a powerful security header that helps prevent cross-site scripting, data injection, and other code injection attacks. We’ll explain how to define and configure a robust CSP policy to restrict the types of content that can be loaded on your website, providing comprehensive protection against various attack vectors.

Header set Content-Security-Policy "default-src https:; font-src https: data:; img-src https: data:; script-src https:; style-src https:;"

The header is setting the allowed source(s) for fonts, images, scripts, and styles. For each of these, a secure HTTPS connection is required. The only exception is also to allow data URIs as a source for fonts and images.

More Information: https://htaccessbook.com/important-security-headers/#csp

X-Frame-Options

Clickjacking attacks exploit the ability to embed your website within an invisible frame, tricking users into performing unintended actions. The X-Frame-Options header allows you to control whether your website can be displayed in frames from other domains. We’ll walk you through the process of setting this header to protect your website from clickjacking attempts.

Header set X-Frame-Options "sameorigin"

HTTP Strict Transport Security (HSTS)

Securing the transmission of data between your website and users is crucial. HSTS ensures that your website is only accessed over a secure HTTPS connection, preventing downgrade attacks and improving overall security. We’ll provide a step-by-step guide on how to enable HSTS for your website.

Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

X-Content-Type-Options

The X-Content-Type-Options header helps protect against MIME type sniffing, a potential security vulnerability where browsers may try to interpret responses in unintended ways. By setting the X-Content-Type-Options header to “nosniff,” you instruct the browser to strictly honor the declared content type and prevent any MIME type guessing. 

Header set X-Content-Type-Options "nosniff"

Feature Policy / Permissions Policy

The Feature Policy (or Permissions Policy) header allows you to control which browser features and APIs can be accessed by your web pages, thereby limiting potential attack vectors. By explicitly specifying the permissions needed for certain features, you can reduce the risk of misuse. 

Header set Feature-Policy "geolocation 'self'; vibrate 'none'"
Header set Permissions-Policy "geolocation=(self), vibrate=()"

X-Permitted-Cross-Domain-Policies

The X-Permitted-Cross-Domain-Policies header deals with cross-domain policy files. These files define permissions for cross-domain communication, such as sharing data between different origins. By setting the X-Permitted-Cross-Domain-Policies header to “none” or “master-only,” you can restrict cross-domain policies and prevent unintended data sharing.

Header set X-Permitted-Cross-Domain-Policies "none"

Referrer Policy

Information leakage through HTTP referrer headers can pose privacy risks. The Referrer Policy header allows you to control the information sent in the referrer field, mitigating the potential exposure of sensitive data. We’ll explain the different referrer policy options and help you choose the most appropriate one for your website.

Header set Referrer-Policy "no-referrer-when-downgrade"

All Security Headers 

Header set X-Frame-Options "sameorigin"
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
Header set X-Content-Type-Options "nosniff"
Header set Referrer-Policy "no-referrer-when-downgrade"
Header set Feature-Policy "geolocation 'self'; vibrate 'none'"
Header set Permissions-Policy "geolocation=(self), vibrate=()"
Header set X-Permitted-Cross-Domain-Policies "none"
Header set Content-Security-Policy "default-src https:; font-src https: data:; img-src https: data:; script-src https:; style-src https:;"
Header set X-XSS-Protection "1; mode=block"

 

How to set up security headers on Windows Server

To set up security headers on Windows Server, you can use the following steps:

  1. Open the Internet Information Services (IIS) Manager.
  2. Click on the website that you want to configure the security headers for.
  3. Click on the Features tab.
  4. Scroll down to the Security Headers section.
  5. Check the boxes next to the security headers that you want to enable.
  6. Click on the Apply button.

How to set up security headers on Linux Server

To set up security headers on Linux Server, you can use the following steps:

  1. Open the Apache configuration file for your website.
  2. Add the following lines to the file:
Header set X-Frame-Options "sameorigin"
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
Header set X-Content-Type-Options "nosniff"
Header set Referrer-Policy "no-referrer-when-downgrade"
Header set Feature-Policy "geolocation 'self'; vibrate 'none'"
Header set Permissions-Policy "geolocation=(self), vibrate=()"
Header set X-Permitted-Cross-Domain-Policies "none"
Header set X-XSS-Protection "1; mode=block"
  1. Save the file and restart Apache.

Conclusion

By setting up security headers, you can help to protect your website from a variety of attacks. The security headers listed in this article are a good starting point, but you may need to add additional headers depending on your specific needs. You can use a tool like Security Headers: https://securityheaders.com/ to test your website’s security headers and make sure that they are configured correctly.

OpenLiteSpeed Guide

IIS WebServer