Implementing HTTP Security Headers in Plesk Print

HTTP security headers tell the user's browser how to behave when handling your website's content. Implementing these headers mitigates attacks like Cross-Site Scripting (XSS), clickjacking, and data injection.

Step-by-Step Navigation in Plesk

1. Log into your Plesk Control Panel.
2. Go to the Websites & Domains section from the left sidebar.
3. Find your target domain name from the dashboard list.
4. Click on the Hosting & DNS tab menu.
5. Select the Apache & nginx Settings tool link.
6. Scroll down to the bottom of the page to find the text entry inputs:
   • Additional nginx directives
   • Additional directives for HTTP
   • Additional directives for HTTPS

Method 1: Nginx Configuration (Recommended)

If your website passes through nginx proxy mode, copy and paste this complete block into the Additional nginx directives text area:

# 1. Protect against clickjacking attacks
add_header X-Frame-Options "SAMEORIGIN" always;

# 2. Prevent browsers from guessing/sniffing MIME types
add_header X-Content-Type-Options "nosniff" always;

# 3. Restrict how much referrer information is leaked
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

# 4. Enforce strict HTTPS connections (HSTS)
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

# 5. Enable legacy browser Cross-Site Scripting protection
add_header X-XSS-Protection "1; mode=block" always;

# 6. Disable access to sensitive hardware features
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()";

# 7. Content Security Policy (Standard / Safe Template)
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' https: data:; connect-src 'self' https:;" always;

Method 2: Apache Configuration

If you have turned off nginx proxy mode and rely purely on Apache, copy and paste this text block into both the Additional directives for HTTP and Additional directives for HTTPS boxes:

# 1. Protect against clickjacking attacks
Header always set X-Frame-Options "SAMEORIGIN"

# 2. Prevent browsers from guessing/sniffing MIME types
Header always set X-Content-Type-Options "nosniff"

# 3. Restrict how much referrer information is leaked
Header always set Referrer-Policy "strict-origin-when-cross-origin"

# 4. Enforce strict HTTPS connections (HSTS)
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

# 5. Enable legacy browser Cross-Site Scripting protection
Header always set X-XSS-Protection "1; mode=block"

# 6. Disable access to sensitive hardware features
Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"

# 7. Content Security Policy (Standard / Safe Template)
Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' https: data:; connect-src 'self' https:;"

Header Details & Definitions

• X-Frame-Options: Setting this to SAMEORIGIN stops malicious external sites from rendering your pages inside invisible iframes to steal user clicks.
• X-Content-Type-Options: Setting this to nosniff forces the browser to strictly follow the content types defined in headers, stopping attackers from executing malicious code disguised as images.
• Referrer-Policy: Protects user privacy by ensuring links clicked on your secure site do not leak full URL query tracking parameters to external domains.
• Strict-Transport-Security (HSTS): Forces the browser to load your website exclusively over secure HTTPS channels for the next year (31,536,000 seconds).
• Permissions-Policy: Instructs the browser to turn off access to physical features like the user's webcam or location tracking for your domain's assets.

Understanding the Content Security Policy (CSP)

The Content-Security-Policy restricts what sources of dynamic content (scripts, styles, images) are allowed to load and run on your website. This is the ultimate defense against Cross-Site Scripting (XSS) and data injection.

The default standard policy provided in the snippets above uses the following directives:

• default-src 'self'; — Acts as a fallback. Anything not explicitly defined below can only load if it originates from your exact domain name.
• script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; — Allows scripts from your own domain, inline scripts, JavaScript execution strings, and any script loaded securely over HTTPS (necessary for many modern tag managers and trackers).
• style-src 'self' 'unsafe-inline' https:; — Allows CSS stylesheets from your domain, inline styling, and external HTTPS stylesheets (such as Google Fonts).
• img-src 'self' data: https:; — Allows images from your website, secure external sites, or embedded base64 data assets.
• font-src 'self' https: data:; — Grants permission to load font files from local paths or external secure paths.
• connect-src 'self' https:; — Controls destinations to which API scripts can send data fetch queries (XHR/WebSockets).