Security headers

Security headers tell the visitor’s browser how to treat your site: whether other sites may show it in a frame, how much of the address to pass on when a visitor follows a link, whether to insist on HTTPS, and which scripts and browser features the page may use. WardPane adds them to every response of the site, so your application and .htaccess need no changes for them.

They are in the site’s settings, on the Advanced tab under Security headers.

Settings

X-Content-Type-Options: nosniff is added to every response regardless of these settings.

X-Frame-Options

This header protects against clickjacking, where another site shows yours inside an invisible frame and tricks visitors into clicking. SAMEORIGIN (the default) allows frames only on your own site, and DENY allows none at all. Turn it off only if other sites must embed your pages.

Referrer-Policy

This one controls what the browser sends in the Referer header when a visitor leaves your site through a link. With the default, strict-origin-when-cross-origin, links within your site get the full address, other sites get only the domain, and a move from HTTPS to HTTP gets nothing. Modern browsers use the same default.

HSTS

HSTS tells browsers to use only HTTPS for your domain, for the next max-age seconds, even if someone types http://. Turn it on only once the certificate works: a browser that has seen the header refuses plain HTTP to the domain until it expires.

• max-age: default 15 552 000 seconds (180 days), up to 63 072 000 (two years).
• includeSubDomains: the rule covers every subdomain too, so check first that all of them have HTTPS.
• preload: marks the domain as ready for the HSTS list built into browsers. The preload list requires HSTS on, a max-age of at least 31 536 000 (one year) and includeSubDomains, so the panel lets you tick it only with all three. Removing a domain from the preload list takes months.

The header is sent only on HTTPS connections, as the standard requires.

Content-Security-Policy and Permissions-Policy

Both are free-text fields for advanced users. A Content-Security-Policy restricts where the page may load scripts, styles, images and frames from. It makes cross-site scripting much harder, and a policy that is too strict breaks the site, so try it on every page type before you rely on it. Permissions-Policy turns off browser features the site does not use, such as the camera, the microphone or geolocation.

A value is limited to 1000 characters and cannot contain line breaks.

When the headers are sent

The headers are added right after the blocklist, the rate limit, Bot Fight Mode, Geo-blocking and the device filter. A response refused by one of those checks goes out without them, and everything later gets them: files, PHP and Node.js responses, error pages, and the answers of hotlink protection, required URL parameters and the password prompt.

If your PHP script or Node.js app sends one of these headers itself, its value replaces the panel’s for that response. Headers set by .htaccess rules are applied on top too (see .htaccess).

Behind Cloudflare in “Flexible” mode, Cloudflare connects to your server over plain HTTP and the HSTS header is not sent. Set HSTS in Cloudflare in that case, or switch to “Full (strict)”.