Sécurité

Security headers

Checks for HSTS, CSP, X-Frame-Options and other security headers.

Vérifier votre site gratuitement

Pourquoi est-ce important ?

Security headers protect visitors from common attacks like XSS, clickjacking and man-in-the-middle. Google prefers secure sites and poor security can damage visitor trust.

Comment le corriger ?

Add the following headers to your server responses: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy. Test via securityheaders.com.

Ce check note de 0 à 100. Sous 50 c’est un échec, 50 à 89 un avertissement, 90 ou plus c’est bon. Après chaque crawl vous voyez la note par page dans le rapport, avec une courte explication.

Questions fréquentes

Checks for HSTS, CSP, X-Frame-Options and other security headers.

Security headers protect visitors from common attacks like XSS, clickjacking and man-in-the-middle. Google prefers secure sites and poor security can damage visitor trust.

Add the following headers to your server responses: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy. Test via securityheaders.com.

Exemple

Copiez le code ci-dessous et adaptez le nom de domaine, la marque et le contenu à votre situation. 

# Nginx: security headers
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;

# Apache .htaccess
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set X-Frame-Options "DENY"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"

# Validate via: https://securityheaders.com
Mixed content
Essai gratuit