Defensive HTTP Security Headers Configuration Guide

Overview of Defensive HTTP Response Headers#

When a browser loads a web page, the web server returns HTTP response headers alongside the HTML content. These headers act as security instructions for the client's browser, dictating what resources can be executed, how connections must be encrypted, and whether the site can be embedded in third-party frames.

Without defensive response headers, browsers default to permissive legacy behaviors, leaving visitors vulnerable to SSL stripping, clickjacking, MIME-sniffing exploits, and referrer data leakage.

---

Key Headers Evaluated by SiteSecura#

SiteSecura's scanner inspects the presence, syntax, and directive strength of the following defensive headers:

1. Strict-Transport-Security (HSTS)#

• Purpose: Instructs browsers that the domain must only be accessed via HTTPS, automatically upgrading all http:// links and blocking users from clicking through SSL warning bypasses.
• Evaluation:
  • Pass: Header present with max-age of at least 15,552,000 seconds (180 days).
  • Fail (High Severity, -15 pts): Missing header.
  • Warning (Low Severity, -2 pts): max-age is less than 6 months.
• Recommended Directive:

  HTTP
  Copy
  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

2. X-Frame-Options (Clickjacking Protection)#

• Purpose: Prevents malicious third-party websites from loading your page inside a hidden <iframe>, an attack known as Clickjacking (UI redressing).
• Evaluation:
  • Pass: Set to DENY (blocks all iframe embedding) or SAMEORIGIN (permits embedding only by the same origin).
  • Fail (High Severity, -15 pts): Missing header (or frame-ancestors directive in CSP).
• Recommended Directive:

  HTTP
  Copy
  X-Frame-Options: SAMEORIGIN

3. X-Content-Type-Options (MIME Sniffing Prevention)#

• Purpose: Prevents browsers from guessing (sniffing) the MIME type of a response when the declared Content-Type header differs from the content, stopping malicious user uploads (e.g. an image containing executable JavaScript) from running as scripts.
• Evaluation:
  • Pass: Set to nosniff.
  • Fail (Medium Severity, -5 pts): Missing header.
• Recommended Directive:

  HTTP
  Copy
  X-Content-Type-Options: nosniff

4. Referrer-Policy#

• Purpose: Governs how much referrer information (the URL of the current page) is transmitted in the Referer header when navigating to other domains.
• Evaluation:
  • Pass: Set to strict-origin-when-cross-origin or no-referrer.
  • Warning (Low Severity, -2 pts): Unrestricted referrer (unsafe-url).
• Recommended Directive:

  HTTP
  Copy
  Referrer-Policy: strict-origin-when-cross-origin

5. Permissions-Policy#

• Purpose: Restricts browser features and hardware APIs (e.g., camera, microphone, geolocation) from being accessed by scripts or embedded iframes.
• Recommended Directive:

  HTTP
  Copy
  Permissions-Policy: camera=(), microphone=(), geolocation=()

---

Server Configuration Examples#

Nginx Configuration#

Add these directives inside your server { ... } block in Nginx:

NGINX
Copy
# Defensive Security Headers
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

Apache Configuration#

Ensure mod_headers is enabled (sudo a2enmod headers) and add to your .htaccess or VirtualHost:

APACHE
Copy
<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>

Cloudflare Transform Rules#

If your website is proxied through Cloudflare, you can inject these headers at the edge without modifying origin server files:

1. Navigate to Rules > Transform Rules in the Cloudflare dashboard.
2. Under Modify Response Header, add rules for Strict-Transport-Security, X-Frame-Options, and X-Content-Type-Options.

---

Verifying Your Changes#

After deploying these headers, run a targeted scan with the Security Headers Checker. The tool provides instant verification of each header's presence, syntax, and security value.