Search Results

Follow the steps below to remediate this finding on Microsoft IIS webserver. Open IIS Manager.Select your website.Double-click HTTP Response Headers.Click Add in the Actions pane and enter:NAME: Strict-Transport-SecurityVALUE: max-age=31536000; includeSubDomai...

Follow the steps below to remediate this finding on Nginx webserver. In your nginx.conf server block (HTTPS only), add:add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;Reload Nginx:sudo systemctl reload nginx

Follow the steps below to remediate this finding on Apache webserver. Ensure mod_headers is enabled:sudo a2enmod headersAdd to your HTTPS VirtualHost or apache2.conf:Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"Relo...

Follow the steps below to remediate this finding on Plesk. Log in to the Plesk control panel.Navigate to Domains > your domain > Apache & nginx Settings.Under "Additional nginx directives", add:add_header Strict-Transport-Security "max-age=31536000; includeSub...

Follow the steps below to remediate this finding on WordPress. Add the following to your theme's functions.php:add_action('send_headers', function() { header('Strict-Transport-Security: max-age=31536000; includeSubDomains; preload'); });Alternatively, if using...

Follow the steps below to remediate this finding on Joomla. Edit the .htaccess file in the Joomla root directory and add:<IfModule mod_headers.c> Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" </IfModule>Alternativel...

Follow the steps below to remediate this finding on Drupal. Install and enable the Security Kit (SecKit) module:composer require drupal/seckit drush en seckitNavigate to Admin > Configuration > System > Security Kit.Under the "HTTP Strict Transport Security" s...

Follow the steps below to remediate this finding on Apache webserver. Prevent direct access to .htaccess files by adding the following to your main Apache configuration (apache2.conf or httpd.conf):<Files ".ht*"> Require all denied </Files>This blocks access t...

Follow the steps below to remediate this finding on Nginx webserver. Nginx does not use .htaccess files. If .htaccess files exist on the server, deny access in your server block:location ~ /\.ht {deny all;}Reload Nginx:sudo systemctl reload nginx