Server Headers
https://observatory.mozilla.org/
https://report-uri.io/home/tools
https://csp-evaluator.withgoogle.com/
https://cspvalidator.org/#url=https://cspvalidator.org/
Chrome Extension to test CSP without actually applying it to the website:
https://chrome.google.com/webstore/detail/caspr-enforcer/fekcdjkhlbjngkimekikebfegbijjafd?hl=en-US
Example Header for nginx
1 2 3 4 5 6 7 8 9 | #Header Security Additions server_tokens off; proxy_hide_header X-Powered-By; add_header Referrer-Policy no-referrer-when-downgrade; add_header X-Frame-Options SAMEORIGIN; add_header X-Content-Type-Options nosniff; add_header X-XSS-Protection "1; mode=block"; add_header Content-Security-Policy "default-src 'none'; script-src 'self' https://www.google-analytics.com/; style-src 'self' https://fonts.googleapis.com; img-src 'self' https://www.google-analytics.com; font-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; frame-src 'self'; frame-ancestors 'none'; form-action 'none'; upgrade-insecure-requests; block-all-mixed-content; reflected-xss block; base-uri $host www.$host; referrer no-referrer-when-downgrade"; |
