Missing security headers SSL

  • Resolved Cali

    (@dirollordi)


    3 years, 12 months ago

    Hello,

    Wordpress telling me this in the health check :

    Missing security headers SSL

    Your .htaccess file does not contain all recommended security headers.

    HTTP Strict Transport Security
    Content Security Policy: Upgrade Insecure Requests
    X-XSS protection
    X-Content Type Options
    Referrer-Policy
    X-Frame-Options
    Expect-CT

    Am I doing something wrong ? I think this appeared with your latest update.

    Thank you for your help.

    The page I need help with: [log in to see the link]

Viewing 5 replies - 16 through 20 (of 20 total)

  • not sure if it matters, but, everything I read on many sites suggested first line, why did you add it to the last? also, type what the health message says, and the the bullet. you need to post more details than you are stating. 

    

<ifModule mod_headers.c>

Header always set Content-Security-Policy “upgrade-insecure-requests;”

</IfModule>

# Security Headers

<IfModule mod_headers.c>

Header set X-XSS-Protection “1; mode=block”

Header set X-Frame-Options “SAMEORIGIN”

Header set X-Content-Type-Options “nosniff”

Header always set Strict-Transport-Security “max-age=63072000; includeSubDomains”

# Header set Content-Security-Policy …

Header set Referrer-Policy “same-origin”

</IfModule>

<IfModule mod_headers.c>

Header set Expect-CT enforce,max-age=2592000,report-uri=”https://domain.com/report”

</IfModule>

    Adding a bit corrected snippet to .htaccess has helped me:

    # BEGIN Really Simple SSL
Header always set Content-Security-Policy "upgrade-insecure-requests"
Header always set Strict-Transport-Security: "max-age=31536000" env=HTTPS
Header always set X-Content-Type-Options "nosniff"
Header always set X-XSS-Protection "1; mode=block"
Header always set Expect-CT "max-age=7776000, enforce"
Header always set Referrer-Policy: "no-referrer-when-downgrade"
# END Really Simple SSL

    Thanks to everyone for a fix!

    hi.

    @sirindesigns, is correct!

    here is the entire contents of the file https:

    # BEGIN WordPress

    <IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteRule .* – [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
    RewriteBase /
    RewriteRule ^index\.php$ – [L]
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule . /index.php [L]
    </IfModule>
    # END WordPress

    # BEGIN Really Simple SSL
    Header always set Content-Security-Policy “upgrade-insecure-requests”
    Header always set Strict-Transport-Security: “max-age=31536000” env=HTTPS
    Header always set X-Content-Type-Options “nosniff”
    Header always set X-XSS-Protection “1; mode=block”
    Header always set Expect-CT “max-age=7776000, enforce”
    Header always set Referrer-Policy: “no-referrer-when-downgrade”
    # END Really Simple SSL`

    Thanks for the provided info! Just tried it with our webpage, however I do get an error message after having uploaded (and activated) the new .htaccess. “Classic” error of page cannot be reached, try later.

    Anything one needs to keep in mind, e.g. with regard to using SuperCache?

    Also the #BEGIN WordPress comment is currently not on top of our .htaccess file – should that (or need that) to be always on top?

    Thanks for any help/thoughts!

Viewing 5 replies - 16 through 20 (of 20 total)
  • The topic ‘Missing security headers SSL’ is closed to new replies.

Tags