Monthly Archives: April 2022

Server security headers

Added to .htaccess file on 20i

# The HTTP Strict-Transport-Security response header (often abbreviated as HSTS) lets a website tell browsers that it should only be accessed using HTTPS, instead of using HTTP.
# The 'max-age' is the time in days you want the warning to be cached for, the below (5184000) would set that to a default of 60 days.
# Be aware that if you set this header, the site will only ever load over HTTPS.
Header set Strict-Transport-Security "max-age=5184000; includeSubDomains; preload"

And

# CORS (Cross-Origin Resource Sharing) is the site is trying to use a mechanism that uses special HTTP headers that tells the browser that the site is requesting access to resources from a different origin/domain
# Apache (the webserver software we utilise) supports CORS out of the box but for security reasons requires a .htaccess rule to add CORS to the HTTP header. The following rule can be added to allow CORS.
Header set Access-Control-Allow-Origin "https://devonccg.nhs.uk"

In 20i security headers admin

Content-Security-Policy

This response header allows web site administrators to control resources the user agent is allowed to load for a given page. Ie only these sources are allowed in iframe content.

frame-src https://devonccg.nhs.uk/ https://intranet.devonccg.nhs.uk/ https://api-bridge.azurewebsites.net/ https://www.googletagmanager.com https://*.google.com https://www.youtube.com https://googleads.g.doubleclick.net  https://plus.browsealoud.com/

Preload styles

In functions.php

// set these styles as PRELOAD
function add_rel_preload($html, $handle, $href, $media) {
    if (is_admin()) {return $html;}

	$html = '<!--'.$handle.'-->'.$html;
	if( $handle=='infocus-style' || $handle=='wp-block-library' ){
		$html ='<link rel="preload" href="'.$href.'" as="style" onload="this.onload=null;this.rel=\'stylesheet\'" id="'.$handle.'" media="all"><noscript><link rel="stylesheet" href="'.$href.'"></noscript>';
	}
    return $html;
}
add_filter( 'style_loader_tag', 'add_rel_preload', 10, 4 );