HTTP Security Headers: HSTS, CSP and More

HSTS: Strict-Transport-Security

HSTS tells the browser to open your site only over HTTPS for a set period. Even if the user types the address with http:// or clicks an old link, the browser goes straight to HTTPS; this makes it harder to intercept the connection in its very first moment.

Strict-Transport-Security: max-age=31536000; includeSubDomains

• max-age: How long the rule is valid, in seconds. 31536000 is one year.
• includeSubDomains: Applies the rule to all subdomains. Don't add this option if you have a subdomain without HTTPS.

Watch out: Browsers remember the HSTS rule for the duration of max-age. Try it with a short duration first (for example max-age=300), and only extend it once you're sure HTTPS works everywhere on your site and your subdomains. The preload option, which gets your site added to the HSTS list built into browsers, is a step that's hard to undo; don't use it unless you're sure what you're doing. We cover setting up SSL in our What is an SSL certificate? article.

X-Content-Type-Options, X-Frame-Options and Referrer-Policy

These three headers can be added to almost any site without risk:

• X-Content-Type-Options: nosniff: Stops the browser from trying to guess a file's type; for example, it prevents a file loaded as an image from being run as a script.
• X-Frame-Options: SAMEORIGIN: Allows your page to be loaded in a frame only on your own site. This blocks attacks where your page is placed in an invisible frame and users are tricked into clicking without realizing it (clickjacking). If your site needs to be embedded on another site, use the frame-ancestors setting in CSP.
• Referrer-Policy: strict-origin-when-cross-origin: On links to other sites, passes on only the domain name, not the full page address. If your addresses carry session information or personal data, this keeps it from leaking.

Permissions-Policy

It turns off browser features your site doesn't use. Even if a script added to your site is compromised, it can't access the camera, microphone or location:

Permissions-Policy: camera=(), microphone=(), geolocation=()

If your site uses one of these features (for example location for a store finder), remove that feature from the list or allow it only for your own domain: geolocation=(self).

Content-Security-Policy (CSP)

CSP is the most powerful header, but also the one that takes the most care to configure. It tells the browser which sources scripts, styles, fonts, images and connections can be loaded from. Sources that aren't allowed are blocked; this makes it harder for a script injected into your site to run or send data.

A simple starting rule:

Content-Security-Policy: default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self'; base-uri 'self'; form-action 'self'

If you use analytics, ad, chat or payment tools, you have to add their domains to the relevant rules; otherwise they won't work.

Applying CSP without breaking your site:

1. Add the rule first with the Content-Security-Policy-Report-Only header. In this mode the browser doesn't block anything; it only logs the sources that violate the rule to the console.
2. Browse every page of your site and note the CSP warnings in the browser console.
3. Add the sources you actually need to the rule.
4. When no warnings are left, change the header to Content-Security-Policy.

Adding headers in Nginx

Add these to your server block:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

• always: Makes sure the header is sent on error pages too.
• An important trap: In Nginx, if you add your own add_header line to a location block, that block stops inheriting all of the add_header lines from the level above. In location blocks where you add something like a cache header, write the security headers again too, or collect the headers in a shared file and add them with include.

Then run sudo nginx -t and sudo systemctl reload nginx. We cover the basics of Nginx in our Nginx installation guide.

Adding them with .htaccess on web hosting

On hosting that uses Apache or LiteSpeed, add them to the .htaccess file in the site's root folder:

<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
    Header always set X-Content-Type-Options "nosniff"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>

A single typo in the .htaccess file can make the whole site return a 500 error; back up the file before making changes and check your site right after. If you get an error, see the steps in our HTTP error codes article.

Secure settings for cookies

Session cookies are as important as security headers. Make sure these attributes are turned on for your application's session cookies:

• Secure: The cookie is only sent over HTTPS connections.
• HttpOnly: The cookie can't be accessed with JavaScript; an injected script can't steal the session cookie.
• SameSite=Lax (or Strict): Limits the cookie from being sent with requests coming from other sites.

WordPress, Laravel and other common software mostly set these themselves when HTTPS is used; if you're writing your own application, check them in the session settings.

Testing

curl -I https://yourdomain.com

The command lists the headers your site sends. You can also see a page's response headers in the Network tab of the developer tools that open with F12 in the browser. Test sites such as securityheaders.com list missing headers and recommendations when you enter your address.

Security headers are one layer of protection; up-to-date software, strong passwords and regular backups are still the basic protection. We cover general security steps for your own server in our Linux server security checklist.

Security headers at Nodesty

On Nodesty web hosting plans, the LiteSpeed web server supports .htaccess rules; you can add security headers to your .htaccess file from the file manager and use HSTS safely with free SSL. Imunify360 also stops malicious requests before they reach your site. If you manage your own web server on an AMD Ryzen 9 9950X VPS, you can define all of the headers however you like in your Nginx configuration.