So.. you've written up what you checked, and what didn't match what ever criteria you had.
But.. what does it mean? Why enforce certain headers? Why enforce certain options? There is a section which kinda looks at this, but not really.
You have a bunch of links at the end for resources, but why not just provide the rationale for each rule or option inclusion in the article as well? What does each prevent or allow and why?
show comments
aetherspawn
It’s ridiculous that the answer to a secure web is for everyone to sprinkle the magic salt and not something on the browser side
show comments
GaProgMan
And if any of the websites use .NET, they can get almost all of the recommended security headers in one line by using a NuGet package I created: https://gaprogman.github.io/OwaspHeaders.Core/
n4pw01f
Nice work! You gave me something to fix!!
show comments
fitsumbelay
for static sites on a VPS it's fair to expect the host to provision these, yes?
So.. you've written up what you checked, and what didn't match what ever criteria you had.
But.. what does it mean? Why enforce certain headers? Why enforce certain options? There is a section which kinda looks at this, but not really.
You have a bunch of links at the end for resources, but why not just provide the rationale for each rule or option inclusion in the article as well? What does each prevent or allow and why?
It’s ridiculous that the answer to a secure web is for everyone to sprinkle the magic salt and not something on the browser side
And if any of the websites use .NET, they can get almost all of the recommended security headers in one line by using a NuGet package I created: https://gaprogman.github.io/OwaspHeaders.Core/
Nice work! You gave me something to fix!!
for static sites on a VPS it's fair to expect the host to provision these, yes?