Increasing your website security with HTTP headers
In this section, we’ll explore an integrated feature that allows you to increase the security of your website, thereby controlling the HTTP headers that are provided as a response from your server. Well-configured HTTP headers are useful for preventing and reducing the risk of certain types of attacks, such as Cross-Site Scripting (XSS) and data injection attacks.
Joomla offers a system plugin that allows you to define HTTP headers to configure a Content Security Policy (CSP) and HTTP Strict Transfer Security (HSTS).
You can act on these advanced settings from the dedicated plugin, called System - HTTP Headers, which you can find by going to System Dashboard | Plugins, filtering by Type, and selecting System.
The plugin offers several options, as displayed in Figure 16.13:
Figure 16.13 – System – HTTP Headers | Plugin
On the mail screen, you can act on the following options...
