HTTP Security Headers

[r_tist]

Just learning about this. There is a lot of info online and difficult to sift through in order to find a decent example in which to mirror for my own site.

Can anyone provide a real example using a phony URL that I can reference?

The code is to go into the .htaccess file, and will hit upon the following areas:

• HTTP Strict Transport Security
• Content Security Policy
• Access-Control-Allow-Origin
• X-FrameOptions
• X-XSS-Protection
• X-Content-Type-Options

Thank you! Some sites automatically create this info for you and include in the site when you publish.

[Nancy OShea]

For specifications and code examples, refer to Mozilla Developer's Network (MDN).

• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
• https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
• https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options