Check security headers #

This task is for administrators and security officers, at go-live, after upgrades and in periodic security reviews. Since September 2026 a default installation sends these headers; verify instead of trusting (Security and audit, step 1).

Contents #

1. Before you start
2. Steps
3. Changing a header
4. Related pages

Before you start #

• curl on any machine that reaches the site; a browser for the cookie check.

Steps #

1. Headers on the public site and the administration:

   curl -sI https://www.example.gov/ | grep -i -E 'x-content-type|x-frame|referrer|permissions|content-security'
   curl -sI https://www.example.gov/admin/user/login | grep -i -E 'x-content-type|x-frame|referrer|permissions|content-security'

   Expected: x-content-type-options: nosniff, x-frame-options: SAMEORIGIN, content-security-policy: frame-ancestors 'self', referrer-policy: strict-origin-when-cross-origin, permissions-policy: camera=(), microphone=(), payment=(), usb=(). The administration also sends a report-only Content Security Policy.

2. Files that must not be served:

   for p in .env .git/config extension/expservices/ezinfo.php; do
     curl -s -o /dev/null -w "$p %{http_code}\n" https://www.example.gov/$p
   done

   Expected: 404 three times.

3. The session cookie: sign in, open the browser's developer tools, Cookies: HttpOnly, SameSite=Lax, and on HTTPS Secure.

Changing a header #

Read the value first, then change it in the override scope through your change process:

./console exp:ini get 'site.ini/HTTPHeaderSettings/SecurityHeaders[Content-Security-Policy]' --allow-root-user

Turn on HSTS only when every name of the site is HTTPS for good: SecurityHeaders[Strict-Transport-Security]=max-age=31536000 (under Velocity, [HTTPSSettings] HSTSMaxAge).

Record the output of the checks with your security review.

Related pages #

• Hardening the host
• CSP reports
• Security standard
• Security review checklist (hosting)
• Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.