Security Response Headers
Security response headers are browser directives sent from the server to enhance website security. They help prevent attacks, protect user data, and control how web content behaves.
These headers defend against threats like clickjacking, cross-site scripting (XSS), cookie theft, and MIME-type spoofing.
Common Security Headers:
Content-Security-Policy (CSP): Blocks XSS, clickjacking, and code injection by controlling what content can load.
Strict-Transport-Security (HSTS): Forces browsers to use HTTPS, preventing downgrade and cookie hijacking attacks.
X-Content-Type-Options: Prevents MIME-type sniffing by enforcing declared content types.
X-Frame-Options: Blocks clickjacking by preventing your site from being framed by others.
X-XSS-Protection: Activates built-in browser filters against XSS (older browsers only).
Referrer-Policy: Controls how much referrer data is sent to other sites, improving user privacy.
Feature-Policy (Permissions-Policy): Restricts use of browser features like camera, microphone, and geolocation.
Access-Control-Allow-Origin (CORS): Defines which domains can access your site’s resources across origins.
Cookie
SecureandHttpOnlyflags: Protect cookies from XSS and JavaScript access.
How to Add Security Headers via .htaccess in cPanel
Log in to cPanel
Go tohttps://pluto.dns-za.com:2083/and log in with your hosting credentials.Open File Manager
Under the Files section, click on File Manager.Navigate to Your Website’s Root Folder
For your primary domain, go to the
public_htmldirectory.For addon domains, go to the relevant subfolder.
Locate the
.htaccessFileIf you don’t see it, click Settings (top-right) and enable Show Hidden Files (dotfiles).
If the file doesn’t exist, click + File to create one named
.htaccess.
Edit the .htaccess File
Right-click on
.htaccessand select Edit.Click Edit again if a pop-up appears.
Add the Security Headers
Paste the following at the top or bottom of the file:
# Security Headers
<IfModule mod_headers.c>
Header set Content-Security-Policy "upgrade-insecure-requests"
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header set X-Xss-Protection "1; mode=block"
Header set X-Frame-Options "SAMEORIGIN"
Header set X-Content-Type-Options "nosniff"
Header set Referrer-Policy "strict-origin-when-cross-origin"
Header set Permissions-Policy "geolocation=self"
</IfModule>
Save Changes
Click Save Changes in the editor, then close the tab.Test Your Site
Visit your site to confirm everything loads correctly.
You can use https://123media.co.za/hsts/ to verify that headers are active.
