HTTP Response Headers

ivansalloum

Hello everyone,

I'm trying to add the HTTP response headers inside the vhost file like this:

add_header X-Frame-Options "SAMEORIGIN";
add_header Strict-Transport-Security "max-age=31536000; includeSubdomains; preload";
add_header X-XSS-Protection "1; mode=block";
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
add_header Referrer-Policy "strict-origin";

But nothing changes. They don't work. Does anyone know how to add them with NGINX?

JohnB

Is this behind cloudflare?

ivansalloum

JohnB I use CF DNS for this website but not proxied yet. Even with proxy, it should work. I used to selfhost WP on the LEMP stack and add these HTTP response headers the way I posted them here. This is the way to add headers in NGINX.

I think the problem is from Enhance.

Andrei

It's not possible at the moment to add these headers in Nginx. Maybe in future versions of Enhance.

If you're using WordPress, you can make a simple WordPress plugin to add them. Ask ChatGPT and it will create it for you.

ivansalloum

Andrei It is very important to add them server-side. I hope the Enhance team takes this seriously.

Andrei

ivansalloum can you expand on why is it very important to add them server-side?

pratik_asabe

ivansalloum It is very important to add them server-side. I hope the Enhance team takes this seriously.

Couple of days back @Adam confirmed that they are thinking of adding support for this but no ETA.. so i suggest wait for this..

ivansalloum

Andrei When you add them client-side or through a plugin, it won't be added in some situations like when serving a page from cache or from cloudflare edge cache. Server-side or cloud-side ensures they are always there.

And there is no reason to not implement the ability to have them server-side since it is only some directives to add to the NGINX vhost file and since adding them don't change anything (current Enhance version), it means that it is Enhance's problem and it should get fixed.

ivansalloum

pratik_asabe Yeah, I know. I'm waiting for it.