Security headers

[Roz8322]

Hi,
I'm new to this and looking for help with Security headers:
Running a report on all of my sites I am met with these:
Missing Content-Security-Policy Header
Missing HSTS Header
Missing Secure Referrer-Policy Header
Missing X-Content-Type-Options Header
Missing X-Frame-Options Header

Does LiteSpeed cache have settings for this? I tried an alternative plug-in HTTP Headers, but that doesn't work with Lightspeed servers, which I'm on.

When entering this code into the php.functions file, and running the reports again the errors are still reported:
function set_custom_http_headers() {
header('Strict-Transport-Security: max-age=31536000; includeSubDomains');
header('Referrer-Policy: no-referrer-when-downgrade');
header('X-Content-Type-Options: nosniff');
header('X-Frame-Options: SAMEORIGIN');
}
add_action('send_headers', 'set_custom_http_headers');
Plus, if i add this line: header('Content-Security-Policy: default-src \'self\';');
it 'breaks my website header.

Any help would be much appreciated please.

 

[Cold-Egg]

Hi @Roz8322
Please check this post https://forum.openlitespeed.org/threads/security-and-expire-headers.4825/, it should help with your requests.

 

[Roz8322]

Hi, thanks for replying. I am looking at the responses and I can't follow. Are you able to offer the answer in more simple terms? I am using LiteSpeed cache as recommended by my host.

 

[Cold-Egg]

Sure, I just added a new section for the security header, please check https://openlitespeed.org/kb/how-to-set-up-custom-headers/#Security_Headers

 

[Roz8322]

Thank you so much, does this workk with LiteSpeed Cache plug in or just open litespeed?

 

[Cold-Egg]

It's web server-related, so it should work with/without cache plugins.

 

[sofia10]

Implementing robust security headers is paramount for web safety. Features like Content Security Policy (CSP) and HTTP Strict Transport Security (HSTS) enhance protection against various cyber threats, ensuring a secure online environment.