SECURITY HEADERS
Security Headers You Set From the Dashboard
Security headers tell browsers how to treat your site: use HTTPS only, refuse to load it in a frame, and limit what scripts can do. Every xCloud site sends a basic set. On WordPress sites you add HSTS, CSP and more with presets in Site Rules, a PRO feature.
- Basic headers on every site
- Presets for six common headers
- Works on Nginx and OpenLiteSpeed
WHY IT MATTERS
What Do Security Headers Protect Against?
Clickjacking
X-Frame-Options stops other sites from loading yours inside a hidden frame.
Injected scripts
Content-Security-Policy limits where scripts, styles and images may load from.
Downgrade to HTTP
Strict-Transport-Security tells browsers to always use HTTPS for your domain.
WHAT YOU GET
Which Security Headers Does xCloud Add?
Some are on by default. The rest you add per site.
Nginx defaults
X-Frame-Options, X-XSS-Protection and X-Content-Type-Options on every site.
OpenLiteSpeed defaults
X-Content-Type-Options, Referrer-Policy and a strict Permissions-Policy.
Edit X-Frame-Options
Choose SAMEORIGIN, DENY, ALLOWALL or ALLOW-FROM on the Security page.
Header presets
Strict-Transport-Security, Referrer-Policy, Permissions-Policy, CSP, X-Content-Type-Options and X-Frame-Options.
Any custom header
Set or unset any response header with your own value.
Free header checker
Test any URL with the xCloud security headers tool.
HOW IT WORKS
How Do You Add Security Headers in xCloud?
Open Site Rules
Open your WordPress site and go to Tools, then Site Rules.
Add a header rule
In Header Rules, pick a preset or type a header name and value.
Save and test
Save the rule, then check the result with the security headers tool.
LIMITS AND PLANS
What Are the Limits?
Site Rules is for WordPress
For other site types, add headers in custom Nginx config or OpenLiteSpeed's vhconf.server.conf.
10 header rules per site
Plus 25 redirect and rewrite rules on the same page.
Site Rules is PRO
Listed as PRO in the Free vs PRO table. Default headers and Edit X-Frame-Options are on every plan.
Needs managed config
If you turned off config regeneration for the site, the header options are hidden.
Frequently Asked Questions
What people ask about Security Headers on xCloud.
What are security headers?
Security headers are HTTP response headers that tell the browser how to handle your site. Common ones are Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
Which security headers does every xCloud site send?
On Nginx, X-Frame-Options, X-XSS-Protection and X-Content-Type-Options. On OpenLiteSpeed, X-Content-Type-Options, Referrer-Policy and a Permissions-Policy that turns off geolocation, microphone and camera.
How do I add HSTS or a Content-Security-Policy?
On a WordPress site, go to Tools, then Site Rules, and add a header rule with the Strict-Transport-Security or Content-Security-Policy preset. Test a strict CSP carefully, since it can block scripts your theme needs.
Can I add security headers to a Laravel or PHP site?
Yes, but not with Site Rules, which is for WordPress. On Nginx, add them as custom Nginx config. On OpenLiteSpeed, add them to the site's vhconf.server.conf file, which xCloud does not overwrite.
How do I check my site's security headers?
Paste your URL into the free xCloud security headers tool. It lists each header your site sends and flags the common ones that are missing.
Harden Your Site Without Editing Config
Add the headers browsers look for, on Nginx or OpenLiteSpeed, from one page.