Security headers vanish when Super Page Cache is enabled

  • Resolved robaxxx

    (@robaxxx)


    1 year, 2 months ago

    Hi there

    I love this plugin and have had it running on my multisite (on IIS) for the past year or so. I use it all at defaults as per your suggestion from a past question. It’s great.

    I also use Defender Security by WPMU Dev to insert Security Headers e.g. X-Frame-Options, X-XSS-Protection and X-Content-Type-Options. I originally set that plugin up before I added Super Page Cache.

    Today I decided to test and confirm the headers are still working, but they are gone.

    If I disable Super Page Cache then the headers work again.

    I’ve been looking through support tickets and plugin settings and I can’t figure out if I can fix it.

    Is it maybe the setting named “Save response headers”? I won’t touch it unless you tell me to.

    Thanks for any advice.
    Rob

Viewing 4 replies - 1 through 4 (of 4 total)
  • Plugin Contributor iSaumya

    (@isaumya)

    Hi @robaxxx,
    When using this plugin, you cannot use another plugin that modifies the response header as it will create conflict. Rather, I would suggest you to add those recurity headers via your server config file like .htaccess or nginx.conf and not via any plugins.

    Alternatively, inside yoru Cloudflare Dashboard > Rules > Transform Rules > Modify Response Header section you can add these security headers, which would be much easier to manage.

    Thread Starter robaxxx

    (@robaxxx)

    Ok, thanks for letting me know iSaumya.

    I’ll investigate the Cloudflare option and also check the IIS method for doing it.

    Regards
    Rob

    Thread Starter robaxxx

    (@robaxxx)

    Just updating this for others looking for a solution.

    I found the IIS > HTTP Response Headers method was the simplest as it is a multisite instance and I only needed to add the headers once to cover all sites.

    The Cloudflare method also worked but has to be done separately for every domain and of course does not cover domains that were not on Cloudflare.

    Plugin Contributor iSaumya

    (@isaumya)

    Hi @robaxxx,
    Glad to know that your problem has been resolved.

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘Security headers vanish when Super Page Cache is enabled’ is closed to new replies.