HTTPS is the foundation; headers build on it.
THE USEFUL ONES
- Strict-Transport-Security: forces browsers to use https for your domain. Covered in its own article.
- X-Content-Type-Options: nosniff, preventing browsers guessing file types.
- X-Frame-Options or frame-ancestors: preventing your site being embedded in someone else's page, which defends against clickjacking.
- Referrer-Policy: controlling what referrer information is sent to other sites.
- Content-Security-Policy: controlling which sources may load resources. Powerful and easy to misconfigure.
ADDING THEM
In .htaccess, using Header always set directives.
A CAUTION
Content-Security-Policy in particular can break a site badly if set without testing, because it blocks anything not explicitly permitted. Start in report-only mode if you use it at all.
WHERE TO START
X-Content-Type-Options and X-Frame-Options are safe and useful. Add HSTS with a short max-age once HTTPS is solid.
Leave Content-Security-Policy until you have time to test it properly.
TESTING
Online header checking tools report which are present and flag misconfigurations.
