Security Headers Baseline SOP
Apply to every public site at the web-server layer.
— Step 1: Set Strict-Transport-Security: max-age=63072000; includeSubDomains; preload — only after you confirm full HTTPS coverage.
— Step 2: Add X-Content-Type-Options: nosniff to stop MIME-type confusion attacks.
— Step 3: Set Referrer-Policy: strict-origin-when-cross-origin.
— Step 4: Replace X-Frame-Options with Content-Security-Policy: frame-ancestors 'self' — newer and more granular.
— Step 5: Build CSP in report-only mode first. Collect violations for a week, then enforce.
— Step 6: Verify with a header scanner and confirm no unsafe-inline slipped into script-src.
Run this every time.
Lockdown Ledger
@LockdownLedger
Security Headers Baseline SOP
Этот пост опубликован в Telegram-канале Lockdown Ledger. Подписаться можно по ссылке: @LockdownLedger.