I want to add more security to my website by adding anti cross site scripting (XSS) security measures.
I am trying to set the headers in my .htaccess file to include the required headers to protect against XSS and clickjacking.
But when I add the headers they are not reflected in my website when I check the network tab in my website.
I also tried adding the headers to my header.php file that I have included in all of my .php files in my website, yet the headers are sent not being sent or shown in the network tab.
Here is my code:
.htaccess file:
RewriteEngine on
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteCond %{REQUEST_URI} !^/\.well-known/cpanel-dcv/[0-9a-zA-Z_-]+$
RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/(?:\ Ballot169)?
RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
RewriteRule !.*\.php$ %{REQUEST_FILENAME}.php [QSA,L]
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} !^/\.well-known/cpanel-dcv/[0-9a-zA-Z_-]+$
RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/(?:\ Ballot169)?
RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
RewriteCond %{SERVER_PORT} 80
RewriteRule (.*) https://%{SERVER_NAME}/$1 [R,L]
Options -Indexes
Header set X-XSS-Protection "1; mode=block"
Header append X-Frame-Options: "SAMEORIGIN"
Header set X-Content-Type-Options nosniff
# BEGIN cPanel-generated php ini directives, do not edit
# Manual editing of this file may result in unexpected behavior.
# To make changes to this file, use the cPanel MultiPHP INI Editor (Home >> Software >> MultiPHP INI Editor)
# For more information, read our documentation (https://go.cpanel.net/EA4ModifyINI)
<IfModule php7_module>
php_flag display_errors Off
php_value max_execution_time 60
php_value max_input_time 60
php_value max_input_vars 1000
php_value memory_limit 256M
php_value post_max_size 32M
php_value session.gc_maxlifetime 1440
php_value session.save_path "/var/cpanel/php/sessions/ea-php70"
php_value upload_max_filesize 64M
php_flag zlib.output_compression Off
</IfModule>
<IfModule lsapi_module>
php_flag display_errors Off
php_value max_execution_time 60
php_value max_input_time 60
php_value max_input_vars 1000
php_value memory_limit 256M
php_value post_max_size 32M
php_value session.gc_maxlifetime 1440
php_value session.save_path "/var/cpanel/php/sessions/ea-php70"
php_value upload_max_filesize 64M
php_flag zlib.output_compression Off
</IfModule>
# END cPanel-generated php ini directives, do not edit
### If mod_rewrite is true...
<IfModule mod_rewrite.c>
Header set X-XSS-Protection "1; mode=block"
Header always append X-Frame-Options SAMEORIGIN
Header set X-Content-Type-Options nosniff
### Prevent Apache from showing its server signature...
ServerSignature off
### Prevent phpinfo from showing details...
RewriteCond %{QUERY_STRING} =PHP[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12} [NC]
RewriteRule .* - [F]
</IfModule>
# X-XSS-Protection
<IfModule mod_headers.c>
Header set X-XSS-Protection "1; mode=block"
Header always append X-Frame-Options SAMEORIGIN
Header set X-Content-Type-Options nosniff
</IfModule>
# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php70” package as the default “PHP” programming language.
<IfModule mime_module>
AddHandler application/x-httpd-ea-php70 .php .php7 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit
header.php file:
<?php
// I included these headers at the top of my header.php file that is included everywhere in my website files.
header("X-XSS-Protection: 1; mode=block");
header("X-Frame-Options: SAMEORIGIN");
?>
I found the issue to be that headers are already being sent error, and the fix for that was to remove the white space before the opening of the php tag in the beginning of my file.
previous code causing the error:
<?php
//my code
?>
removing the whitespace solved the issue:
<?php
//my code
?>