HTTP headers for increased security

Browsers, on the one hand, want to enhance user security, and on the other hand, they want to simplify the work of programmers when working with the site. By making concessions, browsers by default allow certain types of attacks on the site.

To rule out these attacks, configure the following headers on your server:

Content-Security-Policy: form-action ‘self’; frame-ancestors ‘none’; upgrade-insecure-requests - this header does 3 things: allows sending forms from your site only to itself, prohibits displaying pages of your site in an iFrame and instructs the browser to The files for the page were uploaded only using a secure protocol.
X-Frame-Options - this header is already outdated. Its function is performed by the ‘frame-ancestors ‘none’ instruction of the Content-Security-Policy header. But in the absence of such, we check the presence of this header.
Access-Control-Allow-Origin must not be equal to *. This header allows downloading files from any source.
X-Content-Type-Options: nosniff - for HTML, XML, CSS, JavaScript files, specify this header. It prohibits sniffing by MimeType. That is, the operation when the browser interprets the file independently, contrary to the ‘Content-Type` header.
Headers Server',X-Powered-By’, X-Aspnet-Version',X-Aspnetmvc-Version’ - must be deleted. They provide a potential attacker with information about the software used on your server.

PRO subscription for working with the service

Learn more about pricing plans