How do security headers protect my website?<\/h2>\n\n\n\n
You can add an extra layer of security by using HTTP security headers, which can block common malicious activity from negatively affecting your website's performance, stability, and security. Modern browsers support a large set of HTTP headers that can protect against clickjacking, cross-site scripting, and other common attacks.<\/p>\n\n\n\n
What Are Security Headers?<\/h2>\n\n\n\n
The HTTP headers are used to pass additional information between the clients and the server through the request and response header. The security headers are passed through the HTTP header response as rules which browsers have to follow. A header response can inform your browser of a \"Page Not Found\" for example. As to security headers, those are the directives which protect your website in some way, for example by allowing the browser to only load certain types of files from your own domain and reject downloads from third parties. A security directive like that will block a browser from downloading malicious files from another website. The restrictions imposed by the security headers allow you to prevent malicious activities, such as XSS, code injection, clickjacking, etc.<\/p>\n\n\n\n
Let\u2019s have a look at some of the most important security headers that will give your site some much-needed protection. Please bear in mind that all our servers run Apache as web server, so all examples are for this type of web environment.<\/strong><\/p>\n\n\n\n The so-called Clickjacking spoofing technique was very popular back in the day and still is. Attackers still try to trick users into clicking on malicious links by making emails or websites appear as official and legitimate. X-Frame-Options help guard against such attacks by simply limiting or fully disabling iframes present on the site, so your pages cannot be embedded on third-party websites. Here are several examples.<\/p>\n\n\n\n Fully disable the use of iframes:<\/p>\n\n\n\n The page can only be embedded in a frame on a page with the same origin as itself, which means you can only embed pages within your own website:<\/p>\n\n\n\n The embedded page can be displayed in a frame on the specified origin, meaning that your content can be embedded only on a website which you have specified as trusted. This only works in browsers that support this security header and does not work with multiple domains:<\/p>\n\n\n\n The added security is provided only if the user accessing the document is using a browser that supports X-Frame-Options<\/strong>. The Content-Security-Policy<\/strong> HTTP header has a frame-ancestors<\/em> directive which obsoletes this security header for supporting browsers.<\/p>\n\n\n\n The HTTP Content-Security-Policy<\/strong> response header allows website administrators to control resources the browser is allowed to load for a given page. In other words, you can whitelist your site\u2019s content sources. Content Security Policy evaluates and blocks requests for assets.<\/p>\n\n\n\n The CSP mainly detects and mitigates XSS attacks. The user's browser can be exploited by having it load seemingly trusted and secure content, when the loaded assets could in fact expose the victim's browser to the execution of malicious scripts downloaded from an unknown source. The website administrator has the ability to impose restrictions and specify which Internet domains should be considered as safe sources of executables. <\/p>\n\n\n\n In addition to specifying the trusted sources of content loaded on your pages, you can also specify the allowed protocols, e.g. \"always use HTTPS\". However, a good data transfer protection policy consists of not only the implementation of HTTPS but also marking all cookies with the secure attribute as well as redirecting all HTTP requests to HTTPS. Additionally, sites may use HTTP Strict-Transport-Security<\/a> (HSTS) to ensure that the connection between the browsers and the website is always encrypted.<\/p>\n\n\n\n Let's take a look at the list of CSP properties you can use to protect your pages.<\/p>\n\n\n\n For a complete and up-to-date list of properties, refer to Mozilla<\/a>.<\/p>\n\n\n\n One of the most commonly used request headers is \"upgrade-insecure-requests\". To utilize it, you just need to add the following line to the .htaccess<\/strong> file present in the document root of your website:<\/p>\n\n\n\n In a nutshell, this converts all HTTP requests to HTTPS.<\/p>\n\n\n\n Here is another example in which your pages are generally restricted to loading assets from your own domain, but embedded elements from Stripe and YouTube can be loaded on your pages:<\/p>\n\n\n\n frame-src<\/strong> allows you to specify the locations from which content can be embedded to your pages. This differs from frame-ancestors<\/strong>, which enables you to specify the locations that are allowed to embed content from your website.<\/p>\n\n\n\n For any policy, it is recommended that you first run it in report-only mode, so that you first review your setup. It is also recommended that you always use report-uri<\/strong> (deprecated but still used) and report-to<\/strong> (successor of report-uri) when deploying a policy to understand what is being blocked:<\/p>\n\n\n\n For the reporting to work, you need to configure an endpoint to which the reports will be sent. You can check the Mozilla documentation on Content-Security-Policy<\/a> for more information on setting up the script running at the endpoint address, which will actually log the JSON detailing the violation(s).<\/p>\n\n\n\n The following configuration assumes that: <\/p>\n\n\n\n This policy should be carefully considered allowing the content that you intend to load but block everything else.<\/p>\n\n\n\n Blocks a request if the request destination is of type style<\/strong> and the MIME type is not text\/css<\/strong>, or of type script<\/strong> and the MIME type is not a JavaScript MIME type<\/a>. In a nutshell, the following tells the web browser that the Content-Type security headers are deliberately set and should be followed:<\/p>\n\n\n\n To protect your cookies by only sending them via HTTPS (HTTP over SSL\/TLS) and effectively stop attackers from having any chance of eavesdropping on the communication channel between the browser and the server, just add the following to your .htaccess file:<\/p>\n\n\n\n Using this HTTP response security header, you can limit the amount of information that may be shared with third parties.<\/p>\n\n\n\n To always set the default setting for modern browsers, add the following to your .htaccess file:<\/p>\n\n\n\n In modern days, with all the automatic bots crawling your pages in search of vulnerabilities, it is definitely worth it to add security headers as one more layer of protection. The security headers, however, should be added on top of up-to-date software and hardened server environment. Always keep in mind that some security headers require a customized configuration, so you should carefully examine the assets which your website loads to avoid content-related issues. We recommend that you regularly run updates on your applications and revise your custom scripts, so they can remain secure and free of security holes, because keeping the Internet users safe should be of utmost importance for any website. <\/p>\n","protected":false},"excerpt":{"rendered":" The safety of a website can greatly benefit from security headers. We will introduce to you the top 5 security headers, so you can protect your website.<\/p>\n","protected":false},"author":1,"featured_media":11715,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"advgb_blocks_editor_width":"","advgb_blocks_columns_visual_guide":"","footnotes":""},"categories":[6],"tags":[],"class_list":{"0":"post-11705","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-security"},"author_meta":{"display_name":"ICDSoft","author_link":"https:\/\/www.icdsoft.com\/blog\/author\/icdsoft\/"},"featured_img":"https:\/\/www.icdsoft.com\/blog\/wp-content\/uploads\/2023\/03\/Important-Security-Headers-300x150.webp","featured_image_src":"https:\/\/www.icdsoft.com\/blog\/wp-content\/uploads\/2023\/03\/Important-Security-Headers.webp","featured_image_src_square":"https:\/\/www.icdsoft.com\/blog\/wp-content\/uploads\/2023\/03\/Important-Security-Headers.webp","author_info":{"display_name":"ICDSoft","author_link":"https:\/\/www.icdsoft.com\/blog\/author\/icdsoft\/"},"coauthors":[],"tax_additional":{"categories":{"linked":["Security<\/a>"],"unlinked":["Security<\/span>"]}},"comment_count":"0","relative_dates":{"created":"Posted 3 years ago","modified":"Updated 3 years ago"},"absolute_dates":{"created":"Posted on March 22, 2023","modified":"Updated on March 24, 2023"},"absolute_dates_time":{"created":"Posted on March 22, 2023 1:27 pm","modified":"Updated on March 24, 2023 12:00 pm"},"featured_img_caption":"","series_order":"","_links":{"self":[{"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/posts\/11705","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/comments?post=11705"}],"version-history":[{"count":18,"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/posts\/11705\/revisions"}],"predecessor-version":[{"id":11809,"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/posts\/11705\/revisions\/11809"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/media\/11715"}],"wp:attachment":[{"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/media?parent=11705"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/categories?post=11705"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.icdsoft.com\/blog\/wp-json\/wp\/v2\/tags?post=11705"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}X-Frame-Options<\/h2>\n\n\n\n
Header always set X-Frame-Options \"deny\"<\/code><\/pre>\n\n\n\nHeader always set X-Frame-Options \"sameorigin\"<\/code><\/pre>\n\n\n\nHeader always set X-Frame-Options \"allow-from https:\/\/www.trusted-site.com\/\"\n<\/code><\/pre>\n\n\n\nContent-Security-Policy (CSP)<\/h2>\n\n\n\n
![\"Laptop](\"https:\/\/www.icdsoft.com\/blog\/wp-content\/uploads\/2023\/03\/Content-Security-Policy-Simple-Example.webp\")
Cross-site scripting (XSS)<\/h4>\n\n\n\n
Packet sniffing and forced HTTPS<\/h4>\n\n\n\n
Main CSP security header properties<\/h3>\n\n\n\n
\n
Header always set Content-Security-Policy: upgrade-insecure-requests<\/code><\/pre>\n\n\n\nHeader always set Content-Security-Policy \"default-src 'self'; frame-ancestors 'self' *.trusted-domain.com; frame-src 'self' https:\/\/js.stripe.com https:\/\/www.youtube.com\"\n<\/code><\/pre>\n\n\n\n\nHeader always set Reporting-Endpoints default=\"https:\/\/my-domain.com\/reports\"\n\nHeader always set Content-Security-Policy-Report-Only \"default-src 'self'; frame-ancestors 'self' *.trusted-domain.com; frame-src 'self' https:\/\/js.stripe.com https:\/\/www.youtube.com; report-uri \/some-report-uri; report-to default\"\n<\/code><\/pre>\n\n\n\nSetting up a Basic CSP<\/h3>\n\n\n\n
\n
Header always set Content-Security-Policy \"default-src 'self'; frame-ancestors 'self'; form-action 'self';\"<\/code><\/pre>\n\n\n\nX-Content-Type-Options<\/h2>\n\n\n\n
Header always set X-Content-Type-Options \"nosniff\"\n<\/code><\/pre>\n\n\n\nSecure Cookies<\/h2>\n\n\n\n
Header always edit Set-Cookie (.*) \"$1;HttpOnly;Secure\"\nRewriteEngine On\nRewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)\nRewriteRule .* - [F]<\/code><\/pre>\n\n\n\nReferrer-Policy<\/h2>\n\n\n\n
\n
Header always set Referrer-Policy: \"strict-origin-when-cross-origin\"<\/code><\/pre>\n\n\n\nConclusion<\/h2>\n\n\n\n