Secure websites with the right HTTP Security Headers

HTTP Security Headers are special pieces of information that a web server transmits to the browser along with a web page. They give the browser instructions on how to load, display, or block content. This significantly reduces typical security risks such as man-in-the-middle attacks, clickjacking, or the injection of malicious code. With the right security headers, the protective layer of a website can be specifically strengthened – without the user noticing.

HTTP security headers can be set in three different ways:

• via an HTML meta tag in the HTML code
• via a server-side scripting language
• via direct configuration of the web server (e.g., .htaccess)

Set in HTML using a meta tag

<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self'">

Setting in PHP

<?php header("Content-Security-Policy: default-src 'self'; script-src 'self'");

In the .htaccess file

Header add Content-Security-Policy "default-src 'self';"

High importance:

• Strict-Transport-Security (HSTS)
• Content-Security-Policy (CSP)

Medium importance:

• X-Content-Type-Options
• Referrer-Policy
• X-Frame-Options
• Server
• X-Powered-By

Low importance:

• Permissions-Policy
• COOP (Cross-Origin-Opener-Policy)
• CORP (Cross-Origin-Resource-Policy)
• COEP (Cross-Origin-Embedder-Policy)
• CORS (Cross-Origin Resource Sharing)

The Content Security Policy is sent along with the HTTP response header and tells the browser which resources may be loaded. The main purpose of CSP is to prevent cross-site scripting (XSS) and other injections by blocking the execution of unwanted code.

CSP should be set for all requests, not just for the home page.

Recommendation:

• includes frame-ancestors

Risks:

• high: Header is missing
• medium: Includes unsafe-inline / unsafe-eval

The most important information:

• default-src 'self': Defined that resources (e.g., scripts, CSS, images, etc.) may only be loaded from the same domain.
• script-src 'self': Only JavaScript from the same domain is permitted.
• style-src 'self': Allows CSS files to be loaded only from the same domain
• img-src 'self': Only allows images to be loaded from the same domain
• connect-src 'self': Applies to XMLHttpRequests (Ajax), so that requests may only be made to the same domain here.
• object-src 'none': Prevents objects such as Flash files from loading
• frame-ancestors 'none': Prevents the website from being embedded in an <iframe> by other pages, which protects against clickjacking.

Example:

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'; frame-ancestors 'none';

The Referrer Policy determines what information about the origin of a page (the so-called Referrer) is passed on to other websites. For example, if a user opens a link from your website to another website, the browser can send the original URL along with the referrer. With the right referrer policy, you can determine whether this information is transferred completely, only partially, or not at all – thus protecting sensitive data in URLs from unnecessary disclosure.

Recommendation:

• Referrer-Policy: strict-origin-when-cross-origin

Risk:

• medium: if Header is missing
• medium: if unsafe-url or no-referrer-when-downgrade

Example:

Referrer-Policy: strict-origin-when-cross-origin

This HTTP security header can be used to allow or prohibit browser features.

Recommendation:

• Preferably restrictive, without wildcards (*).

Risk:

• Low: If the header is missing

Example:

Permissions-Policy: geolocation=()

Normally, the Same Origin Policy (SOP) prohibits access from one website to resources on other servers. This means that it is not normally possible to load content from domain1.com to domain2.com using XMLHttpRequest, AJAX, or the JavaScript Fetch API. By setting the CORS header, domains can be specified that are allowed access, or wildcards can be assigned to allow all domains.

Example:

Access-Control-Allow-Origin: domain1.com

PHP versions are often displayed here, which can be a risk if these versions are very outdated.

Risk:

• Low/Medium: Depending on the details provided

Recommendation:

• Omit the header or leave it blank

Example (bad example):

X-Powered-By: PHP 8.1.33

SYSSY checks the HTTP Security Headers of the home page and lists them with a traffic light rating system. Red if there are problems, orange if they are not optimal, and green if everything is OK. This gives you a constant overview of all your websites and their Security Headers.

Get support with website management

Want help with website management?
SYSSY works for you in the background!

Register now for free