HSTS and security headers for your website

With every page, your web server sends along headers: short lines with instructions for the browser. They partly determine how securely the browser handles your site. Here you'll read what HSTS is, which other security headers exist, and how to set them up and test them.

First, your site needs a working certificate and must send visitors to https. You can read how in Activating, renewing and troubleshooting an SSL certificate and Forcing visitors to https.

What does HSTS do?

Redirecting to https has one weak moment: the first request over http is still unencrypted. Someone on the same network, for example on public Wi-Fi, can intercept that request. HSTS (HTTP Strict Transport Security) solves this. Your site sends this header over https:

Strict-Transport-Security: max-age=31536000

The browser then remembers that it may only open your site over https. If a visitor later types http://, the browser changes it to https itself, before anything goes over the network. The browser ignores an HSTS header that arrives over plain http.

Part	Meaning
`max-age`	How long the browser remembers it, in seconds. The internet.nl test considers at least one year (`31536000`) sufficient.
`includeSubDomains`	Also applies to all subdomains, such as shop.yourdomain.nl and mail.yourdomain.nl.
`preload`	You request inclusion in the list built into browsers (hstspreload.org). Then even the very first visit is protected. This requires, among other things, one year, `includeSubDomains` and https on all subdomains. Getting removed again takes a long time.
`max-age=0`	Clears the remembered instruction again, on the next visit over https.

Only turn on HSTS once https works everywhere. If a browser has remembered HSTS and encounters a certificate error, the visitor doesn't get a button to continue anyway. If your certificate expires or isn't valid for www, your site is unreachable for those visitors until it's fixed. With includeSubDomains this also applies to every subdomain, such as an old camera or printer page without a certificate. So build it up gradually: start with a short max-age, for example one day (86400), check that everything works and increase it step by step to one year.

HSTS at WebOké

On most of our servers, the web server sends HSTS by default for every website opened over https: Strict-Transport-Security: max-age=31536000. That's one year, without includeSubDomains and without preload. You don't need to do anything for this. On a few servers it isn't enabled by default; there you turn it on yourself. Whether your site already sends HSTS, and with which max-age, you can see in your browser's developer tools or in the internet.nl test (see below).

The HSTS switch in DirectAdmin

In DirectAdmin, go to Domain Setup and click your domain name. If Secure SSL is enabled, you'll see the switch Enable HTTP Strict Transport Security under HSTS. Then click Save to save. You can read how to do this step by step in Always sending visitors to https.

If your site already sends HSTS, you don't need the switch. Only turn it on if your site doesn't send HSTS yet. Set up HSTS in one place: in DirectAdmin or in .htaccess, not both. If the browser receives two HSTS headers, it only uses the first one.

The other security headers

Header	Protects against	Value to start with
`X-Content-Type-Options`	The browser guessing what a file is by itself, which can cause an uploaded "image" to be executed as a script.	`nosniff` (the only valid value)
`Content-Security-Policy: frame-ancestors` or `X-Frame-Options`	Clickjacking: another site loads your page invisibly in a frame, so visitors unknowingly click your buttons.	`frame-ancestors 'self'`, or the older header `X-Frame-Options: SAMEORIGIN`
`Referrer-Policy`	When clicking through to another site, the browser sends along the address of the previous page, sometimes including a search term or order number.	`strict-origin-when-cross-origin`, or stricter `same-origin` or `no-referrer`. Internet.nl only considers the strict values as good.
`Permissions-Policy`	Determines which browser features your page and embedded frames may use, such as camera, microphone and location.	`camera=(), microphone=(), geolocation=()` turns those three off. If your site uses one of those features, leave it out.
`Content-Security-Policy` (full)	Restricts where scripts, styles and images may be loaded from. This makes injected malicious scripts (XSS) much harder.	Custom per site. Avoid `unsafe-inline`, `unsafe-eval` and wildcards.

Setting them up in .htaccess

Place these lines at the top of the .htaccess file in your domain's public_html folder. Make a copy of the file first.

<IfModule mod_headers.c>
  Header always set X-Content-Type-Options "nosniff"
  Header always set Content-Security-Policy "frame-ancestors 'self'"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
  # Only if your site doesn't send HSTS yet (see above):
  # Header always set Strict-Transport-Security "max-age=31536000"
</IfModule>

Only add includeSubDomains once you're sure every subdomain has https. If you use WordPress, you can also set the headers with a plugin. Choose a well-known plugin that's still being updated, and set each header in one place: in the plugin or in .htaccess.

A full Content-Security-Policy can break your site: a rule that's too strict may block, for example, your analytics, your payment button, an embedded video or your chat window. Test it first with the header Content-Security-Policy-Report-Only. It doesn't block anything, but shows in the browser console what would be blocked. If in doubt, leave this to your web developer, or start with just frame-ancestors.

On a VPS with nginx or Caddy

On a VPS you don't use DirectAdmin, and often no .htaccess either. You then put the headers in your web server's configuration. Neither of them sends HSTS or these headers by itself.

nginx: in the server block for port 443:

add_header Strict-Transport-Security "max-age=31536000" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Content-Security-Policy "frame-ancestors 'self'" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

With always, the headers are also sent with error pages. Note: if a location block contains its own add_header, the rules from the server block no longer apply to that location. Repeat them there, or put them in a separate file that you insert everywhere with include. Test the configuration with nginx -t and load it with systemctl reload nginx.

Caddy: in your site's block in the Caddyfile:

header {
	Strict-Transport-Security "max-age=31536000"
	X-Content-Type-Options "nosniff"
	Content-Security-Policy "frame-ancestors 'self'"
	Referrer-Policy "strict-origin-when-cross-origin"
}

Load the change with systemctl reload caddy. For setting up a site with nginx or Caddy, see nginx with a Let's Encrypt certificate and Caddy: a website with automatic https in the VPS guide.

Testing

Internet.nl: enter your domain in the website test at internet.nl.
Your browser: open your site, press F12 (or choose Inspect), go to the Network tab, reload the page and click the first request. Under Response Headers you'll see everything your server sends.
The command line: curl -sI https://yourdomain.nl/ shows the headers.

After every change, check that your site, forms and payment page still work. Also keep your CMS, plugins and themes up to date. See Securing WordPress's wp-login.php.

Cookies at WebOké

Cookie settings

Necessary

Marketing