Securing a website is really a tough task because there are many things that we should consider in order to secure it. HTTP security headers are the first thing that you should start with.
HTTP Headers are very easy to implement and only require a slight web server configuration change. (editing .htaccess file) HTTP security headers provide yet another layer of security by helping to mitigate attacks and security vulnerabilities.
When a user tries to access a page, his browser requests it from a web server. The server then responds with the content along with appropriate HTTP Response Headers which contain meta data, status error codes, cache rules and so on. A big subset of those headers are security headers which instruct your browser exactly how to behave when it handles your website’s content and data
HTTP security headers are a fundamental part of website security. Upon implementation, they protect you against the types of attacks that your site is most likely to come across. These headers protect against XSS, code injection, clickjacking, etc. Here are the 6 HTTP Security Headers that you must implement for your site.
Strict-Transport-Security
HTTP Strict Transport Security is an excellent feature to support your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS. This helps prevent SSL strip attacks when hackers launch a Man-in-the-Middle to redirect all traffic as unencrypted HTTP.
HSTS avoids this by telling your browser that it must always use encryption. You should definitely deploy it, so that regular HTTP traffic gets redirected to the secured, HTTPS site.
<ifmodule mod_headers.c="">
Header always set Strict-Transport-Security: "max-age=31536000" env=HTTPS
</ifmodule>Content Security Policy (CSP)
A content Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets.
This can be considered an improved version of the X-XSS-Protection header which adds another layer of security.
<ifmodule mod_headers.c="">
Header always set Content-Security-Policy "upgrade-insecure-requests;"
</ifmodule>X-Frame-Options
X-Frame-Options tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking.
The x-frame-options header enables clickjacking prevention by disabling iframes on your site. As iframes can be used by hackers to mirror legitimate clicks for their own purposes, this header fully mitigates that risk and prevents cybercriminals from harming your apps and pages.
<ifmodule mod_headers.c="">
Header always append X-Frame-Options SAMEORIGIN
</ifmodule>Referrer-Policy
Referrer Policy is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites. The use of this header can be considered “optional”, but is advised.
<ifmodule mod_headers.c="">
Header set Referrer-Policy "same-origin"
</ifmodule>Feature-Policy
Feature Policy is a new header that allows a site to control which features and APIs can be used in the browser. The feature policy header grants the ability to allow or deny browser features, whether in its own frame or content within an inline frame element.
<ifmodule mod_headers.c="">
Header set Feature-Policy "geolocation 'self'; vibrate 'none'"
</ifmodule>X-Content-Type-Options
X-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content type. The only valid value for this header is “X-Content-Type-Options: nosniff”.
So these are the HTTP security headers that you should implement on your website. This is really a simple task. Just editing the .htaccess file, which is stored on your Cpanel inside the public_html folder. This file is usually found hidden.
