HSTS and security headers, from .htaccess

What you'll achieve

• turn on HSTS, so browsers only open the website via https://;
• add the basic headers, which don't break anything on an ordinary website;
• check that the server sends them.

Before you start

• The SSL certificate is valid and “Force https” is on for the domain and for www (see The free SSL certificate (Let's Encrypt) and Redirect to HTTPS and www). HSTS without a valid certificate blocks the website.
• Make a copy of the .htaccess file: in Enhance, the “Files” tab, right-click .htaccess » “Download”.
• NBT Host servers use Apache, which reads the rules in .htaccess.
• We use the English names from the Enhance interface, exactly as they appear on screen. If the panel opens in another language, switch it to English from the top right: “My account” » “Language”.

What each header does

The steps

A. Add the headers

1. In Enhance, open “Websites”, the website, the “Files” tab and go into public_html.
2. Right-click .htaccess » “Edit”. If it doesn't exist, create it with “New file”.
3. Add at the end of the file:

   <IfModule mod_headers.c>
     Header always set Strict-Transport-Security "max-age=31536000" "expr=%{HTTPS} == 'on'"
     Header always set X-Content-Type-Options "nosniff"
     Header always set X-Frame-Options "SAMEORIGIN"
     Header always set Referrer-Policy "strict-origin-when-cross-origin"
     Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
   </IfModule>

4. For WordPress, put the block outside the # BEGIN WordPress and # END WordPress lines: whatever is between them can be rewritten by WordPress.
5. Click “Save”.

max-age=31536000 means one year. If you want to start carefully, first set max-age=300 (5 minutes), check the website for a day, then raise it to one year.

B. Check

6. Open the website, press F12 (on a Mac, Cmd+Option+I), go to the Network tab, reload the page and click the first row, the page itself. Under Response Headers you should see the headers you added.
7. Or, from Terminal (Mac, Linux) or PowerShell (Windows): curl -I https://domeniul-tau.ro/.
8. Check the important pages: forms, checkout, maps, embedded videos.

What NOT to add unless you know what you're doing

• includeSubDomains and preload for HSTS. With includeSubDomains, any subdomain without a certificate (for example an external service set up on programari.domeniul-tau.ro) becomes unreachable. preload submits the domain to a list built into browsers, which is hard to get off and takes months. A small website doesn't need them.
• Content-Security-Policy (CSP). It's the most powerful header, but also the easiest to get wrong: a CSP that is too strict blocks Google Analytics, fonts, chat or payments. If you want one, start with the version that only reports, Content-Security-Policy-Report-Only, and ask for help from whoever built the website.
• X-Frame-Options on a website that really has to be framed by another website of yours (for example a form placed in an <iframe> on another domain). In that case, remove the line.

If something doesn't work

• The website shows “500 Internal Server Error” after saving. A typo in the block, usually a missing quotation mark. Delete the block, save, and add it again, copied exactly (see Error 500 Internal Server Error and the blank page).
• You don't see the headers. Make sure you saved .htaccess in the website's folder (public_html or the subdomain's folder), then clear the cache (the cache plugin, Cloudflare) and reload.
• After HSTS, a subdomain no longer opens. The subdomain doesn't have a valid certificate. Issue one for it (see The free SSL certificate (Let's Encrypt)). If you added includeSubDomains, remove it; browsers that have seen it remember it until max-age expires.
• An <iframe> from another website of yours no longer loads. That's the effect of X-Frame-Options. Remove the line, or write to us and we'll tell you the CSP frame-ancestors alternative.