Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Does any one know if:
are for HTTP and:
are for HTTPS?
What I mean is that if I have a blog which serves pages on HTTP and has no HTTPS redirection, then only the first 4 headers are necessary. If I host it on HTTPS, only then the remaining 2 headers are necessary?
Or is it that they are required no matter how I host the blog?
If I host it on HTTPS, only then the remaining 2 headers are necessary?
No, that's not enough. Headers aren't mutually exclusive for HTTP or HTTPS.
HTTPS doesn't eliminate the vulnerabilities that some of the headers are meant to protect you against.
E.g., the X-Frame-Optionsheader prevents cross-origin framing to stop clickjacking attacks. This risk is unrelated to an encrypted connection and makes sense for sites served over HTTP and HTTPS likewise.
Also, there are no "HTTPS headers", it's just that HSTS (Strict-Transport-Security) and HPKP (Public-Key-Pins) are HTTP headers that specifically instruct the browser how to behave for HTTPS connections.
[ ...] if I have a blog which serves pages on HTTP and has no HTTPS redirection, then only the first 4 headers are necessary.
Since HSTS instructs the browser to only connect over HTTPS for a given time and HPKP specifies public key hashes for the certificates that the browser should accept, you're correct that these two headers wouldn't make sense for a plain HTTP website. However, depending on your application, just setting the headers from your list won't guarantee you a secure website. I'd recommend you study each header's purpose and other possible measures to protect your site.
