I recognise the importance of configuring HTTP security headers (X-Frame-Options, X-XSS-Protection and X-Content-Type-Options) for web servers (and other internet facing servers such as loadbalancers). But is this necessary for non internet facing servers?

  • Could you elaborate on what servers you are talking about? Is this an internal web application in a company?
    – Sjoerd
    Commented Dec 14, 2018 at 14:28

1 Answer 1


Let's say you have an app running on app.example.com on your local network, and you make it accessible on the internet through a reverse proxy on web.example.com. I would set the headers on app for a number of reasons:

  • You want to keep application logic close to the app. The headers are not one size fits all. You need to understand what you are serving to know how to set them. Therefore it makes more sense to set them on app.example.com.
  • Users on your intranet might browse directly to app.example.com, either on purpose or by mistake. They should still get the proteciton.
  • If an attacker knows the URL to app.example.com, she could leverage it in an attack against users on your intranet. If she can't embed web.example.com in an iframe on evil.com for her attack, she can just embed app.example.com instead.

If you have some minimum level of protection you want everything to have (perhaps you always want XSS proteciton to be on), you can set it on web.example.com as well as an extra failsafe.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .