Configure HTTP Headers
Scan your installation using https://securityheaders.com/.
There are a number of headers which we suggest to enable:
X-Frame-Options tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking.
X-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type.
X-XSS-Protection: 1; mode=block
X-XSS-Protection sets the configuration for the XSS Auditor built into older browsers.
Referrer-Policy is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites.
Strict-Transport-Security should be used after enabling SSL. It strengthens the implementation of TLS by getting the User Agent to enforce the use of HTTPS.
Content-Security-Policy is a new method of enforcing what a user agent can load on a given page. It supersedes
X-XSS-Protectionin modern browsers. All content loaded by SupportPal is served from your servers so the majority of policy directives should be set to
style-srcneed to permit
Please consult your web server documentation for steps on how to configure these headers.