Set HTTP Security Headers Apache WHM

By Raddy in Other · July 25, 2022

HTTP Security Headers are a set of HTTP headers that provide additional security for web servers, browsers, and internet service providers. They are used to protect against a variety of attacks, such as cross-site scripting and clickjacking.

Let’s start by learning how to scan a given website’s security headers.

How to scan for Security Headers

Navigate to Securityheaders.com and simply enter the website that you want to check. The scan will give you a full report of your security headers and also score. If your score is not good enough carry on reading this article.

Now let’s look into the different security headers and what they mean.

Strict-Transport-Security

The HTTP Strict-Transport-Security response header (often abbreviated as HSTS) informs browsers that the site should only be accessed using HTTPS, and that any future attempts to access it using HTTP should automatically be converted to HTTPS.

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

Content-Security-Policy

The HTTP Content-Security-Policy response header allows website administrators to control resources the user agent is allowed to load for a given page. With a few exceptions, policies mostly involve specifying server origins and script endpoints. This helps guard against cross-site scripting attacks (Cross-site_scripting).

For more information, see the introductory article on Content Security Policy (CSP).

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

X-Frame-Options

The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a <frame>, <iframe>, <embed> or <object>. Sites can use this to avoid click-jacking attacks, by ensuring that their content is not embedded into other sites.

The added security is provided only if the user accessing the document is using a browser that supports X-Frame-Options.

Header set X-Frame-Options: DENY

OR

Header set X-Frame-Options: SAMEORIGIN

X-Content-Type-Options

The X-Content-Type-Options response HTTP header is a marker used by the server to indicate that the MIME types advertised in the Content-Type headers should be followed and not be changed. The header allows you to avoid MIME type sniffing by saying that the MIME types are deliberately configured.

Header set X-Content-Type-Options nosniff

Referrer-Policy

The Referrer-Policy HTTP header controls how much referrer information (sent with the Referer header) should be included with requests. Aside from the HTTP header, you can set this policy in HTML.

How to Configure Security Headers Apache HMW

Step 1

Login with your admin HMW account.

Step 2

Use the search bar to look for “Apache Configuration”.

Step 3

Click on “Include Editor”.

Step 4

Under Pre Main Include, Click on the Select Menu and choose “All Versions”.

Copy and paste the Security Headers Code:

Header set X-Frame-Options SAMEORIGIN
Header set X-XSS-Protection 1;mode=block
Header set X-Content-Type-Options nosniff
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
Header always set Referrer-Policy "same-origin"
Header always set Permissions-Policy: interest-cohort=()  

Step 5

Restart Apache

Your security headers should be updated and work on the entire server, covering all websites. Re-scan your website using Securityheaders.com.

Credit: MDN Web Docs

Thank you for reading this tutorial. Share it with friends and family.

Thank you for reading this article. Please consider subscribing to my YouTube Channel. It’s FREE!

More Resources:

• Learn Morgan – HTTP request logger for NodeJs
• Privacy Policy
• Landing Page Design Tutorial with Adobe XD
• Create A Fully Responsive GYM Website using Editor X Platform – Video
• Professional Business Card Design For Creatives (AI)

Author

Hi! I’m Raddy. I am a web developer, often making YouTube Videos, Blog Posts and side projects. Enquiries: [email protected]

Previous Post in Category

Next Post in Category