Browser security: Difference between revisions
Jump to navigation
Jump to search
| Line 14: | Line 14: | ||
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains;" | Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains;" | ||
</syntaxhighlight> | </syntaxhighlight> | ||
= | =HTTP Public Key Pinning (HPKP)= | ||
=Content Security Policy (CSP)= | =Content Security Policy (CSP)= | ||
=Tools= | =Tools= | ||
Revision as of 06:01, 4 September 2020
Resources
- https://caniuse.com/ great for seeing usage across browsers
HSTS HTTP Strict Transport Security
Set up Apache HSTS
In Apache 2 000-default.conf
<VirtualHost *:80>
ServerName example.com
Redirect permanent / https://example.com/
</VirtualHost>
In Apache 2 default-ssl.conf
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains;"