I am very very new in web development, and I need to make my website a little more secure by adding a simple Content-Security-Policy code.

Here are my questions:

  1. Is this line of code Header set Content-Security-Policy "default-src 'self'" enough to prevent adding malicious codes by an unknown user/attacker?

  2. To this code Header set Content-Security-Policy "default-src 'self'" to work, all I need to do is input it in my .htaccess file ?

  • This is for an Apache server, right? – Anders Sep 20 '16 at 14:57
  • Yes, it is for an Apache server – googol8080 Sep 23 '16 at 14:24

The header will prevent resource files from being loaded from anywhere except the source domain.

However, it will not prevent man-in-the-middle or browser hijacks which may dynamically insert changes to the page itself since those are not trying to load a separate resource file as far as the browser is concerned.

Header set Content-Security-Policy "default-src 'self'"

Is indeed the correct Apache .htaccess entry.

To prevent MiTM hijacks, you need to make sure that all resources are delivered encrypted over HTTPS. Use certificate pinning to help prevent MiTM decoding.

To prevent browser hijacks, firstly ensure that all clients have robust ad-blocking installed and updated (if you are on a controlled network, do this at the network level). That prevents drive-by hijacks which are increasingly common. Other forms would come from malware on the PC so ensure that users have constantly updated anti-virus and are familiar with attacks such as phishing, not opening untrusted documents and never running applications unless known. the usual client security stuff.

  • Thanks for the reply, how can I prevent the browser hijacks to insert changes to the page? – googol8080 Sep 20 '16 at 13:06
  • No problem. I've updated the answer. – Julian Knight Sep 20 '16 at 13:39
  • additional question, if I insert that line of code, and I try to post my website to a social media like facebook, will it be loaded or not? – googol8080 Sep 20 '16 at 13:58
  • Don't consider it code but rather configuration. It only applies to configuring Apache Web Server sites. It is ignored if the resources are not delivered via an Apache web server and will still be ignored unless Apache is configured to allow the appropriate .htaccess overrides. So Facebook et al will not make any sense of it. They have their own web servers with their own security measures. – Julian Knight Sep 20 '16 at 14:31
  • what I mean is, If I use that line of code to my website via .htaccess, which runs in Apache web server, and I for example post my website link to facebook, will it be appear in Facebook? Because that line of code says that, it will only load the resources if the one that requesting is my domain? Hope you understand my english. thanks, – googol8080 Sep 21 '16 at 0:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.