What's HTTP's security response head? Why are they so important?

The server returns HTTP when the browser requests a web page Response. These responses include a group of heads, not just metadata, but browser instructions to implement security strategies. By configuring the correct security response header, you can instruct the browser to activate the built-in defense mechanism, thereby significantly enhancing website security without modifying the business code.

Key security heads and their defence capabilities

Strict-Transport-Security (HSTS): Force browser to access the website only through HTTPS. Effectively prevent SSL stripping and middlemen from attacking.
Content-Security-Policy (CSP): The strongest defense head. Almost all types of resources can be blocked by limiting the source of the resource load XSS (cross-site script attack) 。
X-Frame-Options: Control whether pages are allowed to be embedded iframe Medium. This is defense. Crickjacking (click hijacking) Main instruments.
X-Content-Type-Options: Set As nosniff , prevent browsers from trying to guess the mime type by sniffing out the file content, and effectively resist a file-based attack.
Referrer-Policy: Control request Referer Level of disclosure of information, protection of privacy of users.

Addressing “information leak” and “server fingerprint”

In addition to enhanced defence, security head audits include a reduction in information disclosure. Many default configured servers will return:

Server: nginx/1.18.0
X-Powered-By: PHP/7.4.3

This information will tell the attackers the exact version of your server and help them to find known loopholes. Professional security configurations should hide or simplify these heads and make detection of the attackers more difficult.

How do we strengthen?

The consolidation process is usually in a Web server (e.g. Nginx, Apache) or a load balancer (e.g., Claudflare floor. For example, add a head to Nginx:

add_header X-Frame-Options "SAMEORIGIN" always;

Use our Security Header Analyzer, you can scan the current configuration with one key, identify missing key entries and get for Nginx and Apache The repair code clip. This is a mandatory “check-in” tool for every web developer and transporter.