Skip to content

Instantly share code, notes, and snippets.

@KryptikOne

KryptikOne/security-headers.txt

Last active May 30, 2019 14:54
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save KryptikOne/9e26a3c683d63f3e06e49f04141b4ad2 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save KryptikOne/9e26a3c683d63f3e06e49f04141b4ad2 to your computer and use it in GitHub Desktop.
Download ZIP
Security headers for better site security. Also see https://securityheaders.com to test it out
Raw
security-headers.txt
Header set Cache-Control "max-age=604800, public"
Header set X-Content-Type-Options nosniff
Header set X-XSS-Protection "1; mode=block"
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains;" env=HTTPS
Header always append X-Frame-Options SAMEORIGIN
Header set Referrer-Policy: no-referrer-when-downgrade
Header always edit Set-Cookie (.*) "$1; HTTPOnly; Secure; SameSite=strict;"
Header set Content-Security-Policy "default-src 'self' ADD_ADDITIONAL_SOURCES_HERE; script-src 'self' ADD_ADDITIONAL_SOURCES_HERE; style-src 'self' ADD_ADDITIONAL_SOURCES_HERE; font-src 'self' ADD_ADDITIONAL_SOURCES_HERE; img-src 'self' ADD_ADDITIONAL_SOURCES_HERE;"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment