2

I am using Apache server for Wamp application. While doing security testing, I got these error reports which says:

  1. X-Frame-Options Header Not Set. For this I know that there are 3 types of X-Frame Options. But where do I implement the SAMEORIGIN option and how?

  2. X-Content-Type-Options Header Missing.

What do I need to do to solve these? Thank you.

Nicole
  • 37
  • 1
  • 6
  • You can set these in your Apache config files. One note of warning: If you use e.g. Adsense ads doing as suggested by security advidories will break your ads completely. – Alexander Dobernig Feb 02 '21 at 05:27
  • @AlexanderDobernig Sorry I'm new to this, would you mind explaining what is Adsense ads? By the way, do I set it in any lines of my Apache config files? – Nicole Feb 02 '21 at 06:23
  • Adsense is a platform for serving ads from Google to monetize your website. Be very careful with Apache configuration options like this because they can break everything! I did this once and returned little later to the original state as I had a lot of problems. – Alexander Dobernig Feb 02 '21 at 06:30
  • Wow, thanks for the advice! I'll be sure to take note of it. :) – Nicole Feb 02 '21 at 06:33
  • Please also see: https://stackoverflow.com/questions/17092154/x-frame-options-on-apache – Alexander Dobernig Feb 02 '21 at 06:35
  • Note: If you have this WAMP server in your local network or at localhost and it will not be reachable from the Internet, forget the security warnings. If it is a public server on the Internet, there are far more dangers than that. – Alexander Dobernig Feb 02 '21 at 06:41
  • @Nicole take a look at my answer :) – Example person Feb 02 '21 at 06:45

2 Answers2

1

Set the following headers:

X-Frame-Options: SAMEORIGIN
X-Content-Type-options: nosniff

Since you are using Apache, add the following to the apache config:

Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-Content-Type-Options nosniff

The above won't do anything for a local test server. But, you should always set them in public production servers.

Remember: Even though it doesn't do anything for local servers, you could develop your website with this environment, so that it doesn't suffer when you release it on production.

Example person
  • 3,198
  • 3
  • 18
  • 45
-1

Since you are using Apache, add the following to the apache config:

Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-Content-Type-Options nosniff

Works perfect!

Azzam Daaboul
  • 1
  • 1