Security Headers Checker / Headers / Servers and panels

Security headers on Apache

A baseline set of security headers for Apache: HSTS, a Content-Security-Policy in Report-Only mode to start, framing protection, nosniff, a private Referrer-Policy, a Permissions-Policy and the cross-origin headers. Check what each can break below before you deploy, then scan your site to confirm.

The headers

# VirtualHost or .htaccess (needs mod_headers: a2enmod headers).
# "always" also covers error and redirect responses.
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set Content-Security-Policy-Report-Only "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'self'; upgrade-insecure-requests"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), browsing-topics=()"
Header always set Cross-Origin-Opener-Policy "same-origin-allow-popups"
Header always set Cross-Origin-Resource-Policy "same-site"

Will this break anything?

• Strict-Transport-Security: once a browser has seen it, it refuses plain HTTP for this host for max-age seconds (and with includeSubDomains for every subdomain: mail, staging, old tools). Check they all serve HTTPS, start with max-age=300, then raise it. preload is very hard to undo.
• Content-Security-Policy-Report-Only blocks nothing: browsers only report what an enforced policy would block, so it is safe to add first and watch.
• X-Frame-Options: DENY stops every site from framing yours, including your own other domains, booking or payment widgets that frame your pages, and page-builder previews. SAMEORIGIN allows your own origin.
• X-Content-Type-Options: browsers refuse scripts and stylesheets served with the wrong Content-Type (a script sent as text/plain): check your files are served with correct types.
• Referrer-Policy: sites you link to see less about where visitors came from. strict-origin-when-cross-origin still sends your origin, which most referral reports need; no-referrer sends nothing.
• Permissions-Policy: a feature set to () is off for the page and every frame in it, including embedded maps, videos, payment buttons and chat widgets. Check what your page and its embeds use first.
• Cross-Origin-Opener-Policy: same-origin breaks pop-ups that talk back to your page (OAuth sign-in, PayPal and some payment windows); same-origin-allow-popups keeps them working.
• Cross-Origin-Resource-Policy: same-site or same-origin stops other sites from embedding your files (images, fonts, scripts). Files other sites embed on purpose need cross-origin.

Redirect HTTP to HTTPS

# .htaccess or the port-80 VirtualHost (mod_rewrite)
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Cookie flags

# Adds the flags to every Set-Cookie the app sends (mod_headers):
Header always edit Set-Cookie "^((?!.*;\s*Secure).*)$" "$1; Secure"
Header always edit Set-Cookie "^((?!.*;\s*HttpOnly).*)$" "$1; HttpOnly"
Header always edit Set-Cookie "^((?!.*;\s*SameSite).*)$" "$1; SameSite=Lax"