Security response planning tools

Drop-in server directives to instantly remediate missing headers, mitigate clickjacking, and enforce strict HTTPS.

Apache / cPanel (.htaccess) Hardening Patch

<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set X-Content-Type-Options "nosniff"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
</IfModule>

Caddyfile Security Snippet

header {
  Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
  X-Frame-Options "SAMEORIGIN"
  X-Content-Type-Options "nosniff"
  Referrer-Policy "strict-origin-when-cross-origin"
}