How to configure Security Headers in Apache – Quick Sheet

How to configure Security Headers in Apache – Quick Sheet

Enable HSTS
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"


Enable X-Frame-Options
Header always append X-Frame-Options SAMEORIGIN


Enable X-XSS-Protection
Header set X-XSS-Protection "1; mode=block"


Enable X-Content-Type-Options
Header always set X-Content-Type-Options "nosniff"


Enable Referrer-Policy
Header always set Referrer-Policy "strict-origin"


Enable Content Security Policy (CSP)
Header always set Content-Security-Policy "default-src 'self'; font-src*;img-src * data:; script-src *; style-src *;"


Enable Permissions-Policy
Header always set Permissions-Policy "geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()"

 

 

https://fleetfoundation.com/2024/02/25/how-to-configure-security-headers-in-apache-quick-sheet/