Sample Website Security Report

# server { } block (or http { })
add_header Content-Security-Policy-Report-Only "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;

# Requires mod_headers (a2enmod headers)
Header always set Content-Security-Policy-Report-Only "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"

<?xml version="1.0" encoding="utf-8"?>
<!-- web.config: merge into the existing <configuration> element -->
<configuration>
  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <add name="Content-Security-Policy-Report-Only" value="default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" />
      </customHeaders>
    </httpProtocol>
  </system.webServer>
</configuration>

Rules > Transform Rules > Modify Response Header > Create rule
1. Apply to: All incoming requests (or this hostname)
2. Action: Set static
3. Header name: Content-Security-Policy-Report-Only
4. Value: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'
5. Deploy

<?php
// In a small site-specific plugin (or the child theme's functions.php)
add_action( 'send_headers', function () {
    header(
        "Content-Security-Policy-Report-Only: "
        . "default-src 'self'; "
        . "object-src 'none'; "
        . "base-uri 'self'; "
        . "frame-ancestors 'self'"
    );
} );

CloudFront > Policies > Response headers > Create response headers policy
1. Security headers or Custom headers: add Content-Security-Policy-Report-Only = default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'
2. Origin override: enabled
3. Attach the policy to the distribution's cache behavior(s)

# When Nginx proxies an application (nginx 1.19.3+)
proxy_cookie_flags ~ secure httponly samesite=lax;

# Requires mod_headers. Prefer fixing the application; use this as a stopgap.
Header edit Set-Cookie "(?i)^((?:(?!;\s?HttpOnly).)+)$" "$1; HttpOnly"
Header edit Set-Cookie "(?i)^((?:(?!;\s?Secure).)+)$" "$1; Secure"

<?xml version="1.0" encoding="utf-8"?>
<!-- web.config (ASP.NET): merge into the existing <configuration> element -->
<configuration>
  <system.web>
    <httpCookies requireSSL="true" httpOnlyCookies="true" sameSite="Lax" />
  </system.web>
</configuration>

; php.ini (or .user.ini) for the PHP session cookie
session.cookie_secure = 1
session.cookie_httponly = 1
session.cookie_samesite = "Lax"

# server { } block (or http { })
add_header X-Frame-Options "SAMEORIGIN" always;

# Requires mod_headers (a2enmod headers)
Header always set X-Frame-Options "SAMEORIGIN"

<?xml version="1.0" encoding="utf-8"?>
<!-- web.config: merge into the existing <configuration> element -->
<configuration>
  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <add name="X-Frame-Options" value="SAMEORIGIN" />
      </customHeaders>
    </httpProtocol>
  </system.webServer>
</configuration>

Rules > Transform Rules > Modify Response Header > Create rule
1. Apply to: All incoming requests (or this hostname)
2. Action: Set static
3. Header name: X-Frame-Options
4. Value: SAMEORIGIN
5. Deploy

<?php
// In a small site-specific plugin (or the child theme's functions.php)
add_action( 'send_headers', function () {
    header(
        "X-Frame-Options: "
        . "SAMEORIGIN"
    );
} );

CloudFront > Policies > Response headers > Create response headers policy
1. Security headers > X-Frame-Options: SAMEORIGIN
2. Origin override: enabled
3. Attach the policy to the distribution's cache behavior(s)

# http { } block
server_tokens off;

# Main server configuration (not .htaccess)
ServerTokens Prod
ServerSignature Off

<?xml version="1.0" encoding="utf-8"?>
<!-- web.config, IIS 10 (version 1709+): merge into the existing <configuration> element -->
<configuration>
  <system.webServer>
    <security>
      <requestFiltering removeServerHeader="true" />
    </security>
    <httpProtocol>
      <customHeaders>
        <remove name="X-Powered-By" />
      </customHeaders>
    </httpProtocol>
  </system.webServer>
</configuration>

; php.ini (or .user.ini): removes the X-Powered-By: PHP/x.y header
expose_php = Off