\u201cSecuring a website is like riding a bicycle. To keep your balance, you must keep moving.\u201d This is what Albert Einstein\u2019s famous bicycle quote would look like had he been a cybersecurity professional. Fortunately (or not), he wasn\u2019t. Keeping the bicycle analogy going though, you can’t stop pedaling. The moment you do, the bicycle starts slowing down and you eventually just topple over. You don\u2019t want that, do you?<\/p>\n
But when it comes to riding a bicycle, not all pedal strokes are the same. Some are smooth; some are hard, some make you go shorter distances while some take you longer. Today, let’s talk about the ones that will keep your website security bicycle moving for at a brisk pace. Let\u2019s talk about HTTP security headers.<\/p>\n
HTTP security headers are a fundamental part of website security. Upon implementation, they protect you against the types of attacks that your site is most likely to come across. These headers protect against XSS, code injection, clickjacking, etc.<\/p>\n
Let\u2019s hash out HTTP security headers.<\/span><\/p>\n<\/span><\/span>\n When a user visits a site through his\/her browser, the server responds with HTTP Response Headers. These headers tell the browser how to behave during communication with the site. These headers mainly comprise of metadata.<\/p>\n You can use these headers to outline communication and improve web security. Let’s have a look at five security headers that will give your site some much-needed protection.<\/p>\n Let\u2019s say you have a website named example.com and you installed an SSL\/TLS certificate and migrated from HTTP to HTTPS. This is good, right? That was rhetorical. It definitely is. But this isn’t where the work stops. What if your website is still available over HTTP? It would be utterly pointless, right? Many website admins migrate to HTTPS and then forget about it without realizing this. This is where HSTS<\/a> enters the picture.<\/p>\n If a site is equipped with HTTPS, the server forces the browser to communicate over secure HTTPS. This way, the possibility of an HTTP connection is eliminated entirely.<\/p>\n Great, isn\u2019t it?<\/p>\n Syntax:<\/p>\nWhat are HTTP Security Headers?<\/h1>\n
1.\u00a0\u00a0\u00a0\u00a0 HTTP Strict Transport Security (HSTS)<\/h2>\n
Strict-Transport-Security: max-age=<expire-time>\n\nStrict-Transport-Security: max-age=<expire-time>; includeSubDomains\n\nStrict-Transport-Security: max-age=<expire-time>; preload<\/pre>\n
2.\u00a0\u00a0\u00a0\u00a0 Content Security Policy (CSP)<\/h2>\n