autoscale webhosting and automation knowledgebase autoscale webhosting and automation knowledgebase

Configuring Security Headers

Security Headers

Overview

Security Headers help protect your website and visitors by instructing browsers how to handle your website’s content. These settings can improve security, privacy, and protection against common web attacks.

X-DNS-Prefetch-Control

Controls whether browsers are allowed to perform DNS prefetching.

DNS prefetching helps websites load faster by resolving domain names before visitors click links or load resources.

Screenshot2026-07-28181615.png

X-Frame-Options

Controls whether your website can be displayed inside a frame or iframe on another website.

This helps protect against clickjacking attacks.

Common values:

  • DENY
  • SAMEORIGIN
Screenshot2026-07-28181620.png

X-Content-Type-Options

Prevents browsers from guessing file types.

Browsers will only use the file type provided by your server.

Common value:

nosniff
Screenshot2026-07-28181624.png

Referrer-Policy

Controls how much information is shared when visitors click links from your website to another website.

This helps improve visitor privacy.

Screenshot2026-07-28181627.png

Cross-Origin-Resource-Policy (CORP)

Controls which websites can load resources from your website.

This helps prevent unauthorized websites from using your files.

Screenshot2026-07-28181631.png

Cross-Origin-Opener-Policy (COOP)

Helps isolate your website from other websites opened in browser tabs or windows.

This improves security and protects sensitive data.

Screenshot2026-07-28181634.png

Cross-Origin-Embedder-Policy (COEP)

Controls whether your website can load resources from other websites.

Only resources that explicitly allow access can be loaded.

Screenshot2026-07-28181638.png

Strict-Transport-Security (HSTS)

Forces browsers to always use HTTPS when visiting your website.

This helps protect visitors by preventing insecure HTTP connections.

Example:

max-age=31536000
Screenshot2026-07-28181643.png

X-XSS-Protection

Provides protection against certain cross-site scripting (XSS) attacks in supported browsers.

Example:

1; mode=block
Screenshot2026-07-28181646.png

Content-Security-Policy (CSP)

Controls which resources your website is allowed to load, such as scripts, images, stylesheets, and fonts.

This is one of the most powerful website security headers.

Example:

default-src https:;
Screenshot2026-07-28181649.png

Content-Security-Policy-Report-Only

Allows you to test a Content Security Policy without enforcing it.

Violations are reported, but content is not blocked.

This is useful when testing new security policies.

Screenshot2026-07-28181653.png

Expect-CT

Helps detect incorrectly issued SSL certificates by enabling Certificate Transparency monitoring.

Example:

max-age=86400, enforce
Screenshot2026-07-28181656.png

Permissions-Policy

Controls which browser features can be used on your website.

Examples include:

  • Camera access
  • Microphone access
  • Geolocation
  • Fullscreen mode

This allows you to limit features that your website does not need.

Screenshot2026-07-28181700.png

Profiles

Profiles allow you to save your current security header settings and apply them to other websites you manage.

This is useful if you want to use the same security configuration across multiple sites.

Screenshot2026-07-28181604.png

For most websites, consider enabling:

  • X-Frame-Options
  • X-Content-Type-Options
  • Strict-Transport-Security
  • Referrer-Policy
  • Permissions-Policy

Always test your website after making changes to security headers to ensure everything continues to work correctly.

Configuring Web Optimisation →