apache xss protection headers

Setting up Apache to emit NoSniff, X-Frame and X-XSS-Protection headers

Security Headers is a service which checks that your web server is not revealing too much information. It does this by checking the HTTP headers returned with every request. The service checks to see if the server information is being leaked or if it’s reporting what scripting language is being used in the X-Powered-By header.
The service also checks and reports on a list of useful security headers like NoSniff, which prevents browsers from MIME-sniffing a response away from the declared content-type. It also checks for headers which prevent clickjacking and cross site scripting by detecting if X-Frame-Options and X-XSS-Protection are defined.

Add the headers to the Apache config file

I decided it would useful to implement these headers on the web servers I support. In particular I wanted to prevent other sites from framing my content within an iframe. By setting the X-Frame-Options to deny I am explicitly disallowing framing of any type. After a little research, these are the headers that my servers now emit:

<IfModule mod_headers.c>
    Header unset ETag
    Header set X-Frame-Options: deny
    Header set X-XSS-Protection: "1; mode=block"
    Header set X-Content-Type-Options: nosniff
    Header set X-WebKit-CSP: "default-src 'self'"
    Header set X-Permitted-Cross-Domain-Policies: "master-only"
</IfModule>

If your using the Joomla CMS, then using deny on the X-XSS-Protection will prevent the media manager from working properly. In this case you will need to relax the setting to use the same origin policy:

Header set X-Frame-Options: sameorigin