Website security headers and HSTS
With every page, your web server sends along headers: short lines with instructions for the browser. They partly determine how securely the browser handles your site. Here you'll read what HSTS is, what other security headers exist, and how to set them up and test them.
First, your site needs a working certificate and must redirect visitors to https. You can read about that in Activating, renewing and fixing issues with your SSL certificate and Mandatory redirecting of visitors to https.
What does HSTS do?
Redirecting to https has one weak moment: the first request via http is still unencrypted. Someone on the same network, for example on public wifi, can intercept that request. HSTS (HTTP Strict Transport Security) solves that. Your site sends along this header via https:
Strict-Transport-Security: max-age=31536000
The browser then remembers that it may only open your site via https. If a visitor later types http://, the browser itself converts it to https, even before anything goes over the network. The browser ignores an HSTS header that arrives via plain http.
| Part | Meaning |
|---|---|
max-age | How long the browser remembers it, in seconds. The internet.nl test considers at least one year (31536000) sufficient. |
includeSubDomains | Also applies to all subdomains, such as shop.yourdomain.nl and mail.yourdomain.nl. |
preload | You request inclusion in the list built into browsers (hstspreload.org). Then even the very first visit is protected. This requires, among other things, one year, includeSubDomains, and https on all subdomains. Getting removed again takes a long time. |
max-age=0 | Clears the remembered instruction again, on the next visit via https. |
includeSubDomains, that also applies to every subdomain, such as an old camera or printer page without a certificate. Build it up gradually: start with a short max-age, for example one day (86400), check that everything works, and increase it in steps to one year.The HSTS switch in DirectAdmin
In DirectAdmin, go to Domain Setup and click on your domain name. If Secure SSL is enabled, you'll see the Enable HTTP Strict Transport Security switch under HSTS. Then click Save to save it. For step-by-step instructions, read Always redirecting visitors to https.
If you want to know which max-age your site sends along, check your browser's developer tools or the internet.nl test (see below). Set HSTS in one place only: either in DirectAdmin or in .htaccess, not both. If the browser receives two HSTS headers, it only uses the first one.
The other security headers
| Header | Against what | Value to start with |
|---|---|---|
X-Content-Type-Options | The browser starts guessing what a file is, allowing an uploaded "image" to be executed as a script. | nosniff (the only valid value) |
Content-Security-Policy: frame-ancestors or X-Frame-Options | Clickjacking: another site invisibly loads your page in a frame, so visitors unknowingly click on your buttons. | frame-ancestors 'self', or the older header X-Frame-Options: SAMEORIGIN |
Referrer-Policy | When clicking to another site, the browser sends along the address of the previous page, sometimes containing a search term or order number. | strict-origin-when-cross-origin, or stricter same-origin or no-referrer. Internet.nl only considers the strict values as good. |
Permissions-Policy | Determines which browser functions your page and embedded frames may use, such as camera, microphone, and location. | camera=(), microphone=(), geolocation=() disables those three. If your site uses one of those functions, leave it out. |
Content-Security-Policy (full) | Restricts from which locations scripts, styles, and images may load. This makes injected malicious scripts (XSS) much harder. | Custom per site. Avoid unsafe-inline, unsafe-eval, and wildcards. |
Setting it up in .htaccess
Place these lines at the top of the .htaccess file in the public_html folder of your domain. First make a copy of the file.
<IfModule mod_headers.c> Header always set X-Content-Type-Options "nosniff" Header always set Content-Security-Policy "frame-ancestors 'self'" Header always set Referrer-Policy "strict-origin-when-cross-origin" Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()" # Only if the HSTS switch in DirectAdmin is off: # Header always set Strict-Transport-Security "max-age=31536000" </IfModule>
Only add includeSubDomains once you're certain every subdomain has https. If you use WordPress, you can also set the headers with a plugin. Choose a well-known plugin that's still being updated, and set each header in one place only: either in the plugin or in .htaccess.
Content-Security-Policy-Report-Only header. That blocks nothing, but shows in the browser's console what would be blocked. If in doubt, leave this to your web developer, or start with just frame-ancestors.Testing
- Internet.nl: enter your domain in the website test at internet.nl.
- Your browser: open your site, press F12 (or choose Inspect), go to the Network tab, reload the page, and click on the first request. Under Response Headers you'll see everything your server sends along.
- The command line:
curl -sI https://yourdomain.nl/shows the headers.
After every change, check that your site, forms, and payment page still work. Also keep your CMS, plugins, and themes updated. See Securing WordPress's wp-login.php.
Further reading
- MDN: Strict-Transport-Security (English)
- MDN: Content-Security-Policy (English)
- MDN: Permissions-Policy (English)
- HSTS preload list (English)