====== HTTP Security Headers ======

**HTTP Security Headers** are HTTP response headers returned by a web server that instruct the user's web browser to enforce security protections. Enabling these headers strengthens site defense against cross-site scripting (XSS), clickjacking, drive-by downloads, session hijacking, and downgrade attacks.

Deploying properly configured security headers is a core component of web application hardening for web applications and API endpoints.

----

===== Core HTTP Security Headers =====

^ Header ^ Purpose ^ Recommended Value / Baseline ^
| **Content-Security-Policy (CSP)** | Restricts loaded scripts, styles, images, and endpoints to authorized domains, mitigating XSS and data injection attacks. | ''default-src 'self'; script-src 'self'; object-src 'none';'' |
| **Strict-Transport-Security (HSTS)** | Enforces HTTPS connections and prevents SSL stripping attacks. | ''max-age=31536000; includeSubDomains; preload'' |
| **X-Frame-Options** | Protects users against clickjacking by restricting whether the site can be embedded in `<frame>`, `<iframe>`, or `<object>` elements. | ''DENY'' or ''SAMEORIGIN'' |
| **X-Content-Type-Options** | Prevents browsers from MIME-sniffing response content types, forcing adherence to declared `Content-Type` headers. | ''nosniff'' |
| **Referrer-Policy** | Controls how much referrer information is sent along with requests when users click external links. | ''strict-origin-when-cross-origin'' |
| **Permissions-Policy** | Enables or disables access to hardware features (camera, microphone, geolocation, payment APIs) in the browser. | ''geolocation=(), microphone=(), camera=()'' |

----

===== Detailed Header Descriptions & Examples =====

==== 1. Content-Security-Policy (CSP) ====
CSP reduces XSS risk by declaring approved content origins:

<code> http
Content-Security-Policy: default-src 'self'; script-src 'self' https://trustedscripts.example.com; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests;
</code>

==== 2. HTTP Strict Transport Security (HSTS) ====
HSTS ensures web browsers interact with your web server strictly via encrypted HTTPS connections:

<code> http
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
</code>
  * **max-age:** Duration (in seconds) that the browser remembers to enforce HTTPS (31536000 = 1 year).
  * **includeSubDomains:** Applies rule to all subdomains (e.g., `wiki.telenegar.ir`).
  * **preload:** Qualifies the domain for inclusion in browser HSTS preload lists.

==== 3. X-Frame-Options ====
Defends against clickjacking overlays:

<code> http
X-Frame-Options: SAMEORIGIN
</code>

==== 4. X-Content-Type-Options ====
Prevents executable content masquerading as benign media assets:

<code> http
X-Content-Type-Options: nosniff
</code>

==== 5. Referrer-Policy ====
Protects sensitive path data from leaking to third-party destinations:

<code> http
Referrer-Policy: strict-origin-when-cross-origin
</code>

----

===== Server Configuration Examples =====

==== Nginx ====
Add these directives inside your `server` block:

<code> nginx
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';" always;
</code>

==== Apache (`.htaccess` or `httpd.conf`) ====
Ensure `mod_headers` is enabled and add:

<code> apache
<IfModule mod_headers.c>
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "strict-origin-when-cross-origin"
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none';"
</IfModule>
</code>

----

===== Verification & Testing =====

You can verify and test your HTTP Security Header implementation using **Telenegar Tools** or terminal commands:

==== Using Telenegar Tools ====
  * **DNS & Web Check:** Verify domain configuration and SSL/TLS health using the [[tools:dnscheck|Telenegar DNS Check Tool]].
  * **Mail Security Check:** Audit domain security headers alongside email records using the [[tools:mailcheck|Telenegar Mail Check Tool]].

==== Using Terminal Commands ====

=== curl (Linux / macOS) ===
<code> bash
curl -I https://telenegar.ir
</code>

----

===== Related Documentation =====

  * [[tools:dnscheck|Telenegar DNS Check Tool]] — Diagnostic tool for DNS resolution and HTTPS health checks.
  * [[tools:mailcheck|Telenegar Mail Check Tool]] — Diagnostic tool for email authentication and domain security.
  * [[email:clients:webmail|Webmail]] — Security header requirements for webmail deployments.
  * [[email:security:email-encryption|Email Encryption]] — Transport security and TLS parameters.