Implementing HTTP Security Headers in Plesk Print

HTTP security headers tell the user's browser how to behave when handling your website's content. Implementing these headers mitigates attacks like Cross-Site Scripting (XSS), clickjacking, and data injection.

Step-by-Step Navigation in Plesk

1. Log into your Plesk Control Panel.
2. Go to the Websites & Domains section from the left sidebar.
3. Find your target domain name from the dashboard list.
4. Click on the Hosting & DNS tab menu.
5. Select the Apache & nginx Settings tool link.
6. Scroll down to the bottom of the page to find the text entry inputs:
   • Additional nginx directives
   • Additional directives for HTTP
   • Additional directives for HTTPS

Method 1: Nginx Configuration (Recommended)

If your website passes through nginx proxy mode, copy and paste this complete block into the Additional nginx directives text area:

# 1. Protect against clickjacking attacks
add_header X-Frame-Options "SAMEORIGIN" always;

# 2. Prevent browsers from guessing/sniffing MIME types
add_header X-Content-Type-Options "nosniff" always;

# 3. Restrict how much referrer information is leaked
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

# 4. Enforce strict HTTPS connections (HSTS)
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

# 5. Enable legacy browser Cross-Site Scripting protection
add_header X-XSS-Protection "1; mode=block" always;

# 6. Disable access to sensitive hardware features
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()";

Method 2: Apache Configuration

If you have turned off nginx proxy mode and rely purely on Apache, copy and paste this text block into both the Additional directives for HTTP and Additional directives for HTTPS boxes:

# 1. Protect against clickjacking attacks
Header always set X-Frame-Options "SAMEORIGIN"

# 2. Prevent browsers from guessing/sniffing MIME types
Header always set X-Content-Type-Options "nosniff"

# 3. Restrict how much referrer information is leaked
Header always set Referrer-Policy "strict-origin-when-cross-origin"

# 4. Enforce strict HTTPS connections (HSTS)
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

# 5. Enable legacy browser Cross-Site Scripting protection
Header always set X-XSS-Protection "1; mode=block"

# 6. Disable access to sensitive hardware features
Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"

Header Details & Definitions

• X-Frame-Options: Setting this to SAMEORIGIN stops malicious external sites from rendering your pages inside invisible iframes to steal user clicks.
• X-Content-Type-Options: Setting this to nosniff forces the browser to strictly follow the content types defined in headers, stopping attackers from executing malicious code disguised as images.
• Referrer-Policy: Protects user privacy by ensuring links clicked on your secure site do not leak full URL query tracking parameters to external domains.
• Strict-Transport-Security (HSTS): Forces the browser to load your website exclusively over secure HTTPS channels for the next year (31,536,000 seconds).
• Permissions-Policy: Instructs the browser to turn off access to physical features like the user's webcam or location tracking for your domain's assets.