HTTP Security Response Headers For Web

HTTP Security Response Headers For web Security olatunjiadetunji.seowebanalyst.com/2022/02/03/HTTP-Security-Response-Headers-For-web.html

8 HTTP Security Response Headers For web Security HTTP response header helps to forward additional information about a hypertext transfer protocol with the request a browser makes to a URL, one of the merits of this is it prevents information disclosure, and how a web browser interacts with the website what functions the browser can utilize from the website.

The balance between usability and security strikes a tough bargain for developers when implementing functionality through the headers that can make applications more versatile or secure. But in practice, how are the headers being implemented? Does your site follow the best implementation practices?

1/6

Using the right Security Header Response policies adds another security level that can stop common attacks such as code injection, cross-site scripting attacks, and clickjacking to mention a few. For most CMS sites such as WordPress and hosts using Apache servers, these Header Response policies can be set via the .htaccess file.

Header Set Security Policies 1.) X-Frame Security Policy The 'X Frame Options' Security header is one of the easier policies to implement. It provides clickjack protection by preventing your website from being shown in , or tags.

By adding the below code to the top of your .htaccess file you'll add the 'X Frame Options' response header to your site and will only allow your site to be framed by your own domain name, you can also use the options "deny" in the option to call your Header to the browser not to embed web pages in iframe options

<IfModule mod_headers.c>

Header set X-Frame-Options "sameorigin" <IfModule mod_headers.c>

2.) Content Security Policy

2/6

CSP or Content Security Policy response header prevents code injection or cross-site scripting attack by denying the execution of malicious contents from untrusted sites. CSP header instructs the browser from which location and which type of resources are allowed to be loaded in short it controls the domain URLs that are permitted to interact with your site resources, meaning any outbound or external URL resources will not be permitted to load your website resources if they are not added to your Content Security Policy and then have the appropriate rules applied against them. You can deploy the code below for better execution of the CSP.

<IfModule mod_headers.c>

Header set Content-Security-Policy "default-src * data:; script-src https: 'unsafe-inline' 'unsafe-eval'; style-src https: 'unsafe-inline'" <IfModule mod_headers.c>

3.) X-XSS-Protection Policy X-XSS-Protection security header response is one of the security policies designed to protect your website against cross-site scripting aka xss attack what it does is to enable the cross-site scripting filter which is found on modern browsers like chrome and Mozilla.

The best configuration for this .htaccess code will enable the XSS filter and add another layer of security to your site:

<IfModule mod_headers.c>

Header set X-XSS-Protection "1; mode=block" <IfModule mod_headers.c>

4.) X Content-Type Options The X Content-Type Options security header provides protection against MIME sniffing attacks. The header will instruct the browser that content type should not be changed and be followed.

To add this security header to your site simply add the below code to your htaccess file:

<IfModule mod_headers.c>

Header set X-Content-Type-Options "nosniff"

3/6

<IfModule mod_headers.c>

5.) X Permitted Cross-Domain Policy This policy prevents any Adobe resources on your sites like PDF's and Flash from being abused. By adding the below htaccess snippet you'll prevent hotlinking and stop resource abuse from other sites that try to load your site's assets.

To add this security header to your site simply add the below code to your htaccess file:

<IfModule mod_headers.c>

Header set X-Permitted-Cross-Domain-Policies "none" <IfModule mod_headers.c>

6.) Strict Transport Policy The strict transport security header forces the web browser to ensure all communication is sent via a secure HTTPS connection. If your site is serving mixed content then implementing this will break your site. Ensure that all URLs are being served as HTTPS before adding this to your .htaccess file.

To add this security header to your site simply add the below code to your htaccess file:

<IfModule mod_headers.c>

Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" <IfModule mod_headers.c>

7.) Refer to Security Policy The 'Referrer Policy' header controls what information is passed on to the next site whenever a link is clicked on your site. Its purpose is to prevent 'Reverse TabNapping' used in phishing attacks.

If an external link has the target="_blank" attribute value it provides partial access to the referring page via the 'window. opener object'. A Referrer-Policy helps to prevent phishing attacks by restricting access to the 'window. opener object'.

There are a few options when setting the correct 'Referrer Policy' and you need to be careful not to set a policy that is too strict if your site deals with affiliate links.

Recommended Read: Great article about Referrer Policy Recommended Read: More technical specs about Referrer Policy 4/6

Recommended Read: More great info about noopener, noreferrer, and nofollow Values To add this security header to your site simply add the below code to your .htaccess file:

<IfModule mod_headers.c>

Header set Referrer-Policy "no-referrer-when-downgrade" <IfModule mod_headers.c>

7.) Feature Policy Header The 'Feature Policy' security header controls what features the web browser can use while users are on your site or viewing your site through an iframe. There is a long list of features that web browsers use such as geolocation, microphones, cameras, etc. The 'Feature Policy' controls which of those features may be used on your site and which origin URLs are allowed to control them.

Recommended Read: Feature Policy implementation guide For most of my sites I use this simple policy which does the following: Completely disable the camera/WebCam on my sites Allows for geolocation from any URL (geolocation *) Only allows the microphone to be activated from my site only <IfModule mod_headers.c>

Header set Feature-Policy "camera 'none'; fullscreen 'self'; geolocation *; microphone 'self' https://www.example/*" <IfModule mod_headers.c>

8.) Expect CT Header Policy The Expect CT header policy instructs web browsers to either report or enforce Certificate Transparency requirements. This can stop miss-issued SSL certificates and can be set to either report mode or enforce mode.

Without an 'Expect CT' It's much easier for attackers to utilize miss-issued certificates. If you're going to set it to enforce mode then you definitely need to exercise caution to ensure everything is configured correctly with your SSL. On the majority of my sites I use the full enforce mode as per the below example: <IfModule mod_headers.c>

5/6

Header set Expect-CT: enforce, max-age=31536000, report-uri="https://your.reporturi.com/r/d/ct/enforce" <IfModule mod_headers.c>

You can also just use the report only mode like this: <IfModule mod_headers.c>

Header set Expect-CT: max-age=31536000, report-uri="https://your.reporturi.com/r/d/ct/report" <IfModule mod_headers.c>

I will advise before deployment you need to ask for support from your host provider to know what features they support, while some of these security measures will work for some websites, I could only get 6 to work for me due to my SSL type (not wild card and resources are a mix of HTTP and HTTPS) the code below are the ones that worked:

<IfModule mod_headers.c>

Header set Feature-Policy "camera 'none'; fullscreen 'self'; geolocation *; microphone 'self' https://www.domain.com/*" Header set Referrer-Policy "no-referrer-when-downgrade" Header set X-Frame-Options "sameorigin" Header set X-XSS-Protection "1; mode=block" Header set X-Content-Type-Options "nosniff" Header set X-Permitted-Cross-Domain-Policies "none" <IfModule mod_headers.c>

6/6