Skip to content

Instantly share code, notes, and snippets.

View cftad's full-sized avatar
:shipit:

Timothy Deakin cftad

:shipit:
View GitHub Profile

Keybase proof

I hereby claim:

To claim this, I am signing this object:

@cftad
cftad / .htaccess
Last active October 26, 2019 12:05
.htaccess security headers
# Security Headers - https://securityheaders.com
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" env=HTTPS
Header always set Content-Security-Policy "upgrade-insecure-requests" env=HTTPS
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Referrer-Policy: no-referrer-when-downgrade
Header always set Feature-Policy "microphone 'none'; payment 'none'; sync-xhr 'self' https://example.com"
Header unset "X-Powered-By"
<FilesMatch "\.(htm|html|php)$">
Header set X-Frame-Options "SAMEORIGIN"