When building a new website, I always make sure it goes through a series of checklists before deploying.<\/p>\n
One of the things on my checklist is securing the HTTP response headers.<\/p>\n
By securing the HTTP security headers of your website, you\u2019ll prevent common attacks such as:<\/p>\n
Before we get started, go ahead and test the security of your website headers right now using: securityheaders.com<\/a><\/p>\n NOTE: The following HTTP Security Header snippets are placed in the .htaccess file.<\/p>\n This snippet will prevent browsers from executing your site in an iframe. Essentially, it\u2019ll prevent attackers from clickjacking, or showing your content on their site in the form of an iframe.<\/p>\n The disadvantage to this however, is iframe will be disabled completely. You won\u2019t be able to view your site from stumbleupon<\/a> or use tools such as mobiletest.me<\/a>.<\/p>\n <IfModule mod_headers.c> This snippet will activate the cross-site scripting (XSS) filters used by most modern browsers (ie. Chrome, IE), which helps protect your site from certain cross-site scripting attacks.<\/p>\n <IfModule mod_headers.c> This snippet will reduce the risk of drive-by downloads on your site by stopping the browser from executing the wrong MIME and forcing it to stick with the declared content-type.<\/p>\n <IfModule mod_headers.c> This snippet will enforce the use of strict transport security, which will force the browser to access your website only through a safe HTTPS connection. The max-age is set to 31,536,000 which is approximately 1 year.<\/p>\n <IfModule mod_headers.c> After adding the snippets via .htaccess, go ahead and run your site through securityheaders.com again to see if you did everything correctly.<\/p>\n1. The X-Frame-Options Header<\/b><\/h2>\n
\nHeader always append X-Frame-Options \u201csameorigin”
\n<\/IfModule><\/p>\n2. The X-XSS-Protection Header<\/b><\/h2>\n
\nHeader set X-XSS-Protection “1; mode=block”
\n<\/IfModule><\/p>\n3. The X-Content-Type-Options Header<\/b><\/h2>\n
\nHeader set X-Content-Type-Options “nosniff\u201d
\n<\/IfModule><\/p>\n4. The Strict Transport Security Header<\/b><\/h2>\n
\nHeader set Strict-Transport-Security “max-age=31536000”
\n<\/IfModule><\/p>\n