You're browsing the documentation for an old version of SupportPal. Consider upgrading to the [latest version](https://docs.supportpal.com/current/Configure+Http+Headers). 

# Configure HTTP Headers

Scan your installation using <https://securityheaders.com/>.

There are a number of headers which we suggest to enable:

- `X-Frame-Options: SAMEORIGIN`  
     [X-Frame-Options](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options) tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking.
- `X-Content-Type-Options: nosniff`  
     [X-Content-Type-Options](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options) stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type.
- `X-XSS-Protection: 1; mode=block`  
     [X-XSS-Protection](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection) sets the configuration for the XSS Auditor built into older browsers.
- `Referrer-Policy: strict-origin-when-cross-origin`  
     [Referrer-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/referrer-policy) is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites.
- `Strict-Transport-Security: max-age=31536000`  
     [Strict-Transport-Security](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/strict-transport-security) should be used after enabling SSL. It strengthens the implementation of TLS by getting the User Agent to enforce the use of HTTPS.
- `Content-Security-Policy: upgrade-insecure-requests`  
     [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/content-security-policy) is a new method of enforcing what a user agent can load on a given page. It supersedes `X-Frame-Options`, `X-Content-Type-Options`, `X-XSS-Protection` in modern browsers. All content loaded by SupportPal is served from your servers so the majority of policy directives should be set to `self`. `script-src` and `style-src` need to permit `unsafe-inline` as at this time our templates have a lot of inline JavaScript and CSS without nonces.

Please consult your web server documentation for steps on how to configure these headers.