Configure HTTP-Security-Header in Plesk

Plesk offers the option of adding additional HTTP headers to all HTTP responses. This option should only be used if the web application used can still provide these independently.

Configuration

Log in to the Plesk Control Panel via our Customer Center at account.creoline.com. Then navigate to the website for which you want to provide additional HTTP headers and click on Apache & NGINX in the Hosting tab. In the last section under "Additional nginx instructions", add the desired headers according to the following scheme:

add_header <name of the header> <value>;

Important HTTP headers

Below we summarize some important HTTP security headers:

Strict-Transport-Security (HSTS)

This header enforces the use of HTTPS by informing the browser that the website may only be accessed via a secure connection. This prevents a user from inadvertently communicating via an insecure HTTP connection.

Example:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Referrer-Policy

This header determines what information is sent to the target page in the Referer header when a user navigates from one page to another. This makes it possible to control the disclosure of sensitive information about the origin of requests.

Example:

Referrer policy: no-referrer

Content-Security-Policy

This header protects against cross-site scripting (XSS) and other code injection attacks by specifying which resources (e.g. scripts, styles) may be loaded from a website. A restrictive configuration can be used to block harmful content.

Example:

Content-Security-Policy: default-src 'self'; script-src 'self' https://trusted.com

Permissions-Policy

With this header, a website can specify which APIs and functions (e.g. camera, microphone, geolocation) may be used by the browser. In this way, access to potentially abusable interfaces can be restricted.

Example:

Permissions policy: geolocation=(), microphone=()

X-Frame-Options

This header prevents clickjacking attacks by controlling whether a web page may be embedded within an `