{"id":2448,"date":"2026-10-02T09:10:12","date_gmt":"2026-10-02T06:10:12","guid":{"rendered":"https:\/\/www.namebox.ro\/blog\/?p=2448"},"modified":"2026-10-02T09:13:11","modified_gmt":"2026-10-02T06:13:11","slug":"security-headers-htaccess","status":"publish","type":"post","link":"https:\/\/www.namebox.ro\/blog\/security-headers-htaccess\/","title":{"rendered":"Security Headers \u00een .htaccess: Cum protejezi un website"},"content":{"rendered":"<p><strong>Security Headers<\/strong> sunt headere HTTP trimise de server c\u0103tre browser prin care pot fi definite reguli suplimentare de securitate pentru website. Acestea pot controla, de exemplu, dac\u0103 pagina poate fi \u00eenc\u0103rcat\u0103 \u00eentr-un iframe, din ce surse pot fi \u00eenc\u0103rcate scripturile \u0219i imaginile sau dac\u0103 browserul trebuie s\u0103 foloseasc\u0103 exclusiv HTTPS.<\/p>\n<p>Pe un website g\u0103zduit \u00eentr-un mediu <strong>cPanel + LiteSpeed Enterprise<\/strong>, mai multe dintre aceste headere pot fi configurate direct din fi\u0219ierul <strong>.htaccess<\/strong>, f\u0103r\u0103 acces root la server.<\/p>\n<p>Totu\u0219i, nu toate Security Headers pot fi copiate \u00eentr-o configura\u021bie universal\u0103. Unele, precum <strong><br \/>\nX-Content-Type-Options<\/strong>, <strong>X-Frame-Options<\/strong> \u0219i <strong>Referrer-Policy<\/strong>, sunt relativ simplu de implementat pentru majoritatea website-urilor. Altele, \u00een special <strong>Content-Security-Policy<\/strong>, <strong>Permissions-Policy<\/strong> \u0219i <strong>Strict-Transport-Security<\/strong>, trebuie configurate \u0219i testate \u00een func\u021bie de website.<\/p>\n<p>O configura\u021bie gre\u0219it\u0103 poate bloca JavaScript, CSS, fonturi, imagini, iframe-uri, servicii externe sau chiar subdomenii \u00eentregi. Din acest motiv, \u00eenainte de orice modificare este important s\u0103 faci un backup al fi\u0219ierului .htaccess.<\/p>\n<h2>Ce sunt HTTP Security Headers?<\/h2>\n<p>Atunci c\u00e2nd browserul acceseaz\u0103 un website, serverul trimite un r\u0103spuns HTTP care con\u021bine at\u00e2t con\u021binutul solicitat, c\u00e2t \u0219i o serie de headere.<\/p>\n<p>Un r\u0103spuns simplificat poate ar\u0103ta astfel:<\/p>\n<pre>HTTP\/2 200\r\ncontent-type: text\/html; charset=UTF-8\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nreferrer-policy: strict-origin-when-cross-origin<\/pre>\n<p>Unele dintre aceste headere ofer\u0103 browserului instruc\u021biuni suplimentare despre modul \u00een care trebuie tratat\u0103 pagina.<\/p>\n<p>Security Headers pot ajuta la limitarea riscurilor asociate cu:<\/p>\n<ul>\n<li>clickjacking;<\/li>\n<li>MIME type sniffing;<\/li>\n<li>anumite forme de Cross-Site Scripting \u2013 XSS;<\/li>\n<li>\u00eenc\u0103rcarea unor resurse din surse neautorizate;<\/li>\n<li>expunerea inutil\u0103 a informa\u021biilor din Referer;<\/li>\n<li>utilizarea neautorizat\u0103 a camerei, microfonului sau geoloca\u021biei;<\/li>\n<li>downgrade-ul conexiunilor HTTPS c\u0103tre HTTP.<\/li>\n<\/ul>\n<p>Security Headers reprezint\u0103 \u00eens\u0103 doar un nivel al securit\u0103\u021bii website-ului. Acestea nu \u00eenlocuiesc actualizarea aplica\u021biei, parolele sigure, autentificarea cu doi factori, ModSecurity, Imunify360, backup-ul sau certificatul SSL.<\/p>\n<p>Pentru mai multe informa\u021bii despre protec\u021bia la nivel de web server po\u021bi consulta \u0219i articolul <a href=\"https:\/\/www.namebox.ro\/blog\/eroare-403-modsecurity\/\"><strong>ModSecurity \u00een cPanel \u0219i eroarea 403<\/strong><\/a>.<\/p>\n<h2>Cum verifici Security Headers trimise de website?<\/h2>\n<p>\u00cenainte s\u0103 modifici configura\u021bia este recomandat s\u0103 verifici ce headere sunt deja trimise.<\/p>\n<p>Dac\u0103 ai acces la Terminal, Linux, macOS, Windows Terminal sau SSH, po\u021bi utiliza:<\/p>\n<pre>curl -I https:\/\/exemplu.ro<\/pre>\n<p>\u00cenlocuie\u0219te:<\/p>\n<pre>exemplu.ro<\/pre>\n<p>cu domeniul pe care dore\u0219ti s\u0103 \u00eel verifici.<\/p>\n<p>De exemplu, po\u021bi primi:<\/p>\n<pre>HTTP\/2 200\r\ncontent-type: text\/html; charset=UTF-8\r\nserver: LiteSpeed\r\nx-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nreferrer-policy: strict-origin-when-cross-origin<\/pre>\n<p>Pentru a afi\u0219a doar headerele de securitate care ne intereseaz\u0103 putem folosi:<\/p>\n<pre>curl -sI https:\/\/exemplu.ro | grep -iE 'content-security|x-frame|x-content-type|referrer-policy|permissions-policy|strict-transport'<\/pre>\n<p>Dac\u0103 dore\u0219ti s\u0103 verifici headerele folosind un request GET real, nu HEAD, po\u021bi utiliza:<\/p>\n<pre>curl -s -D - -o \/dev\/null https:\/\/exemplu.ro\/<\/pre>\n<h3>Verificarea din browser<\/h3>\n<p>Headerele pot fi verificate \u0219i f\u0103r\u0103 Terminal.<\/p>\n<p>\u00cen Google Chrome, Firefox sau Edge deschide:<\/p>\n<p><strong>Developer Tools \u2192 Network<\/strong><\/p>\n<p>Re\u00eencarc\u0103 pagina, selecteaz\u0103 documentul principal \u0219i verific\u0103:<\/p>\n<p><strong>Headers \u2192 Response Headers<\/strong><\/p>\n<p>Aici vei putea vedea headerele trimise efectiv utilizatorului.<\/p>\n<h2>Cum modifici fi\u0219ierul .htaccess din cPanel?<\/h2>\n<p>Pe un cont cPanel, fi\u0219ierul .htaccess poate fi modificat direct din File Manager.<\/p>\n<p>Autentific\u0103-te \u00een cPanel \u0219i acceseaz\u0103:<\/p>\n<p><strong>cPanel \u2192 Files \u2192 File Manager<\/strong><\/p>\n<p>Dac\u0103 ai nevoie de informa\u021bii despre accesarea panoului po\u021bi consulta tutorialul <a href=\"https:\/\/www.namebox.ro\/documentatie\/cum-accesam-contul-cpanel\/\"><strong>Cum acces\u0103m contul cPanel?<\/strong><\/a>.<\/p>\n<p>Navigheaz\u0103 c\u0103tre document root-ul website-ului. Pentru domeniul principal acesta este frecvent:<\/p>\n<pre>\/public_html<\/pre>\n<p>Pentru un domeniu suplimentar poate exista un document root separat.<\/p>\n<p>Dac\u0103 fi\u0219ierul:<\/p>\n<pre>.htaccess<\/pre>\n<p>nu este vizibil, apas\u0103:<\/p>\n<p><strong>Settings \u2192 Show Hidden Files (dotfiles)<\/strong><\/p>\n<p>\u0219i salveaz\u0103 setarea.<\/p>\n<h3>F\u0103 un backup \u00eenainte de modificare<\/h3>\n<p>\u00cenainte s\u0103 editezi .htaccess este recomandat s\u0103 \u00eel descarci sau s\u0103 creezi o copie.<\/p>\n<p>De exemplu:<\/p>\n<pre>.htaccess-backup<\/pre>\n<p>Dac\u0103 apare o eroare dup\u0103 modificare, po\u021bi reveni rapid la configura\u021bia ini\u021bial\u0103.<\/p>\n<p>\u00cen cazul unui website WordPress, este recomandat s\u0103 nu introduci regulile personalizate \u00eentre:<\/p>\n<pre># BEGIN WordPress\r\n\r\n# END WordPress<\/pre>\n<p>WordPress poate rescrie automat con\u021binutul acestei sec\u021biuni. Regulile personalizate pot fi ad\u0103ugate \u00eenainte sau dup\u0103 blocul administrat de WordPress.<\/p>\n<p>Pentru mai multe exemple de utilizare a fi\u0219ierului .htaccess po\u021bi consulta \u0219i ghidul despre <a href=\"https:\/\/www.namebox.ro\/blog\/redirect-website-de-la-http-la-https\/\"><strong>redirectarea HTTP c\u0103tre HTTPS<\/strong><\/a>.<\/p>\n<h2>Security Headers pe cPanel \u0219i LiteSpeed<\/h2>\n<p>Este important s\u0103 separ\u0103m rolurile tehnologiilor utilizate pe server.<\/p>\n<p>Pe infrastructura NameBox sunt utilizate tehnologii precum <strong>cPanel, LiteSpeed Enterprise, CloudLinux \u0219i Imunify360<\/strong>, \u00eens\u0103 fiecare are un rol diferit.<\/p>\n<p><strong>LiteSpeed Enterprise<\/strong> este serverul web care proceseaz\u0103 request-urile HTTP\/HTTPS \u0219i genereaz\u0103 r\u0103spunsurile c\u0103tre browser. LiteSpeed ofer\u0103 compatibilitate cu configura\u021biile Apache utilizate \u00een mediile cPanel \u0219i permite configurarea Security Headers prin .htaccess.<\/p>\n<p><strong>cPanel<\/strong> ofer\u0103 interfa\u021ba prin care utilizatorul \u00ee\u0219i poate administra fi\u0219ierele \u0219i poate modifica .htaccess.<\/p>\n<p><strong>CloudLinux<\/strong> este utilizat pentru izolarea conturilor \u0219i administrarea resurselor precum CPU, memorie \u0219i I\/O. CloudLinux nu este componenta care aplic\u0103 Security Headers.<\/p>\n<p><strong>AlmaLinux<\/strong> este sistemul de operare pe care poate rula serverul, nu componenta care proceseaz\u0103 aceste headere HTTP.<\/p>\n<p>Pentru mai multe informa\u021bii despre serverul web po\u021bi consulta articolul <a href=\"https:\/\/www.namebox.ro\/blog\/ce-este-litespeed\/\"><strong>LiteSpeed vs Apache<\/strong><\/a>.<\/p>\n<h2>A. Security Headers relativ sigure pentru majoritatea website-urilor<\/h2>\n<p>Urm\u0103toarele trei headere reprezint\u0103 un punct bun de plecare pentru multe website-uri.<\/p>\n<p>Chiar \u0219i \u00een cazul acestora este recomandat\u0103 testarea dup\u0103 modificare.<\/p>\n<h3>X-Content-Type-Options: nosniff<\/h3>\n<p>Headerul:<\/p>\n<pre>X-Content-Type-Options: nosniff<\/pre>\n<p>\u00eei spune browserului s\u0103 respecte tipul MIME declarat de server prin Content-Type \u0219i s\u0103 nu \u00eencerce s\u0103 interpreteze o resurs\u0103 ca fiind de alt tip.<\/p>\n<p>Configura\u021bia poate fi ad\u0103ugat\u0103 \u00een .htaccess astfel:<\/p>\n<pre>&lt;IfModule mod_headers.c&gt;\r\nHeader always set X-Content-Type-Options \"nosniff\"\r\n&lt;\/IfModule&gt;<\/pre>\n<p>De exemplu, un fi\u0219ier JavaScript trebuie s\u0103 fie trimis cu un Content-Type corespunz\u0103tor pentru JavaScript, iar un fi\u0219ier CSS trebuie s\u0103 fie livrat ca text\/css.<\/p>\n<p>Este important de re\u021binut c\u0103 <strong>nosniff nu repar\u0103 Content-Type-urile configurate gre\u0219it<\/strong>. Dac\u0103 serverul livreaz\u0103 o resurs\u0103 cu un MIME type incorect, aceasta poate fi blocat\u0103 de browser dup\u0103 activarea headerului.<\/p>\n<h3>X-Frame-Options: SAMEORIGIN sau DENY?<\/h3>\n<p><strong>X-Frame-Options<\/strong> controleaz\u0103 dac\u0103 o pagin\u0103 poate fi \u00eenc\u0103rcat\u0103 \u00een interiorul unui frame sau iframe.<\/p>\n<p>Headerul poate limita riscul atacurilor de tip <strong>clickjacking<\/strong>, unde un website este \u00eenc\u0103rcat \u00eentr-un iframe \u0219i suprapus cu alte elemente pentru a determina utilizatorul s\u0103 realizeze ac\u021biuni pe care nu le inten\u021biona.<\/p>\n<p>Dou\u0103 valori importante sunt:<\/p>\n<pre>SAMEORIGIN\r\nDENY<\/pre>\n<p><strong>SAMEORIGIN<\/strong> permite afi\u0219area paginii \u00eentr-un frame atunci c\u00e2nd originea este aceea\u0219i.<\/p>\n<p>Exemplu:<\/p>\n<pre>Header always set X-Frame-Options \"SAMEORIGIN\"<\/pre>\n<p><strong>DENY<\/strong> nu permite \u00eenc\u0103rcarea paginii \u00eentr-un frame, indiferent de origine.<\/p>\n<pre>Header always set X-Frame-Options \"DENY\"<\/pre>\n<p>Pentru majoritatea website-urilor obi\u0219nuite, SAMEORIGIN este mai flexibil.<\/p>\n<p>Dac\u0103 website-ul nu trebuie niciodat\u0103 afi\u0219at \u00eentr-un iframe, poate fi analizat\u0103 utilizarea DENY.<\/p>\n<p>Dac\u0103 aplica\u021bia trebuie integrat\u0103 \u00een iframe-uri de pe alte domenii, X-Frame-Options poate deveni prea restrictiv. \u00cen configura\u021biile moderne poate fi utilizat\u0103 \u0219i directiva CSP:<\/p>\n<pre>frame-ancestors<\/pre>\n<p>care permite politici mai precise.<\/p>\n<h3>Referrer-Policy: strict-origin-when-cross-origin<\/h3>\n<p>Atunci c\u00e2nd utilizatorul acceseaz\u0103 un link c\u0103tre alt\u0103 pagin\u0103, browserul poate trimite informa\u021bii despre pagina de pe care a venit prin headerul:<\/p>\n<pre>Referer<\/pre>\n<p>Referrer-Policy permite controlarea cantit\u0103\u021bii de informa\u021bii transmise.<\/p>\n<p>O valoare echilibrat\u0103 pentru multe website-uri este:<\/p>\n<pre>strict-origin-when-cross-origin<\/pre>\n<p>Configura\u021bia:<\/p>\n<pre>Header always set Referrer-Policy \"strict-origin-when-cross-origin\"<\/pre>\n<p>permite transmiterea mai multor informa\u021bii pentru navigarea \u00een cadrul aceleia\u0219i origini, dar limiteaz\u0103 informa\u021biile transmise c\u0103tre alte origini.<\/p>\n<p>La trecerea de la HTTPS c\u0103tre o destina\u021bie HTTP mai pu\u021bin sigur\u0103, informa\u021bia Referer nu este transmis\u0103.<\/p>\n<h2>Exemplu .htaccess pentru cele trei headere de baz\u0103<\/h2>\n<p>Pentru multe website-uri, un punct de pornire poate fi:<\/p>\n<pre>&lt;IfModule mod_headers.c&gt;\r\n    Header always set X-Content-Type-Options \"nosniff\"\r\n    Header always set X-Frame-Options \"SAMEORIGIN\"\r\n    Header always set Referrer-Policy \"strict-origin-when-cross-origin\"\r\n&lt;\/IfModule&gt;<\/pre>\n<p>Aceste headere sunt relativ u\u0219or de implementat, dar configura\u021bia trebuie verificat\u0103 dup\u0103 salvarea fi\u0219ierului.<\/p>\n<p><strong>Nu ad\u0103uga automat \u0219i urm\u0103toarele headere \u00een acela\u0219i bloc f\u0103r\u0103 s\u0103 \u00een\u021belegi efectul lor.<\/strong><\/p>\n<h2>B. Security Headers care trebuie adaptate website-ului<\/h2>\n<p>Content-Security-Policy, Permissions-Policy \u0219i HSTS pot oferi protec\u021bii suplimentare importante, dar trebuie configurate \u00een func\u021bie de modul \u00een care func\u021bioneaz\u0103 website-ul.<\/p>\n<p>O regul\u0103 copiat\u0103 de pe alt site poate produce probleme majore.<\/p>\n<h2>Content-Security-Policy \u2013 CSP<\/h2>\n<p><strong>Content-Security-Policy<\/strong> este unul dintre cele mai puternice Security Headers disponibile browserelor moderne.<\/p>\n<p>CSP permite administratorului s\u0103 defineasc\u0103 sursele din care pagina are voie s\u0103 \u00eencarce diferite tipuri de con\u021binut.<\/p>\n<p>De exemplu, o politic\u0103 poate spune:<\/p>\n<pre>JavaScript \u2192 doar de pe domeniul propriu\r\nCSS \u2192 domeniul propriu + Google Fonts\r\nImagini \u2192 domeniul propriu + CDN\r\niframe \u2192 doar YouTube\r\nAPI \u2192 doar anumite endpoint-uri<\/pre>\n<p>Browserul va putea bloca resursele care nu respect\u0103 politica.<\/p>\n<h3>Ce poate limita Content Security Policy?<\/h3>\n<p>O configura\u021bie CSP bine realizat\u0103 poate reduce impactul unor vulnerabilit\u0103\u021bi \u0219i atacuri precum:<\/p>\n<ul>\n<li>Cross-Site Scripting \u2013 XSS;<\/li>\n<li>injectarea de scripturi;<\/li>\n<li>\u00eenc\u0103rcarea resurselor din surse neautorizate;<\/li>\n<li>anumite forme de clickjacking;<\/li>\n<li>executarea unor elemente injectate \u00eentr-o pagin\u0103 compromis\u0103.<\/li>\n<\/ul>\n<p>CSP nu repar\u0103 \u00eens\u0103 vulnerabilitatea aplica\u021biei. Aceasta reprezint\u0103 un strat suplimentar de protec\u021bie aplicat de browser.<\/p>\n<h3>Directive importante CSP<\/h3>\n<p>O politic\u0103 CSP este alc\u0103tuit\u0103 din mai multe directive.<\/p>\n<h3>default-src<\/h3>\n<p>Define\u0219te politica implicit\u0103 pentru tipurile de resurse care nu au o directiv\u0103 mai specific\u0103.<\/p>\n<pre>default-src 'self'<\/pre>\n<p><strong>&#8216;self&#8217;<\/strong> reprezint\u0103 aceea\u0219i origine ca website-ul curent.<\/p>\n<h3>script-src<\/h3>\n<p>Controleaz\u0103 sursele din care poate fi \u00eenc\u0103rcat \u0219i executat JavaScript.<\/p>\n<pre>script-src 'self'<\/pre>\n<p>O astfel de regul\u0103 este foarte restrictiv\u0103 \u0219i poate bloca Google Analytics, Google Tag Manager, reCAPTCHA, scripturile procesatorilor de pl\u0103\u021bi sau JavaScript inline.<\/p>\n<h3>style-src<\/h3>\n<p>Controleaz\u0103 sursele CSS.<\/p>\n<pre>style-src 'self'<\/pre>\n<p>Poate afecta Google Fonts, stylesheet-uri externe \u0219i stiluri inline generate de WordPress, teme sau page builders.<\/p>\n<h3>img-src<\/h3>\n<p>Controleaz\u0103 sursele din care pot fi \u00eenc\u0103rcate imaginile.<\/p>\n<p>De exemplu:<\/p>\n<pre>img-src 'self' data: https:<\/pre>\n<p>Acest exemplu permite imagini din propria origine, data URI \u0219i surse HTTPS, dar trebuie analizat \u00een func\u021bie de website.<\/p>\n<h3>font-src<\/h3>\n<p>Controleaz\u0103 sursele fonturilor.<\/p>\n<pre>font-src 'self'<\/pre>\n<p>Dac\u0103 website-ul utilizeaz\u0103 Google Fonts sau un CDN extern, politica trebuie adaptat\u0103.<\/p>\n<h3>connect-src<\/h3>\n<p>Controleaz\u0103 destina\u021biile c\u0103tre care pot fi realizate anumite conexiuni din browser, de exemplu prin Fetch, XMLHttpRequest sau WebSocket.<\/p>\n<p>Este important pentru:<\/p>\n<ul>\n<li>API-uri;<\/li>\n<li>Google Analytics;<\/li>\n<li>servicii externe;<\/li>\n<li>aplica\u021bii JavaScript;<\/li>\n<li>servicii de monitorizare.<\/li>\n<\/ul>\n<h3>frame-src<\/h3>\n<p>Controleaz\u0103 sursele care pot fi \u00eenc\u0103rcate \u00eentr-un iframe.<\/p>\n<p>Este relevant pentru servicii precum:<\/p>\n<ul>\n<li>YouTube;<\/li>\n<li>Google Maps;<\/li>\n<li>reCAPTCHA;<\/li>\n<li>procesatori de pl\u0103\u021bi;<\/li>\n<li>platforme video;<\/li>\n<li>widget-uri externe.<\/li>\n<\/ul>\n<h3>frame-ancestors<\/h3>\n<p>Controleaz\u0103 ce site-uri au voie s\u0103 \u00eencarce pagina ta \u00eentr-un iframe.<\/p>\n<p>De exemplu:<\/p>\n<pre>frame-ancestors 'self'<\/pre>\n<p>are un rol similar cu X-Frame-Options SAMEORIGIN, dar permite configura\u021bii CSP mai flexibile.<\/p>\n<h3>form-action<\/h3>\n<p>Poate limita destina\u021biile c\u0103tre care formularele din pagin\u0103 au voie s\u0103 trimit\u0103 date.<\/p>\n<pre>form-action 'self'<\/pre>\n<p>Acest lucru trebuie verificat dac\u0103 website-ul utilizeaz\u0103 formulare care trimit utilizatorul c\u0103tre procesatori de pl\u0103\u021bi sau servicii externe.<\/p>\n<h2>De ce nu exist\u0103 o configura\u021bie CSP universal\u0103?<\/h2>\n<p>Fiecare website \u00eencarc\u0103 resurse diferite.<\/p>\n<p>Un site simplu poate utiliza exclusiv fi\u0219iere locale, \u00een timp ce un magazin online sau un website WordPress poate comunica cu zeci de servicii externe.<\/p>\n<p>Printre serviciile care trebuie analizate se num\u0103r\u0103:<\/p>\n<ul>\n<li>Google Fonts;<\/li>\n<li>Google Analytics;<\/li>\n<li>Google Tag Manager;<\/li>\n<li>YouTube;<\/li>\n<li>Google Maps;<\/li>\n<li>Google reCAPTCHA;<\/li>\n<li>Cloudflare sau alte CDN-uri;<\/li>\n<li>Meta Pixel;<\/li>\n<li>chat-uri externe;<\/li>\n<li>procesatori de pl\u0103\u021bi;<\/li>\n<li>API-uri;<\/li>\n<li>fonturi \u0219i scripturi furnizate de teme sau pluginuri.<\/li>\n<\/ul>\n<p>\u00cen WordPress, situa\u021bia poate deveni \u0219i mai complex\u0103 deoarece o tem\u0103, un plugin sau un page builder poate ad\u0103uga JavaScript \u0219i CSS inline.<\/p>\n<p>Pentru informa\u021bii despre administrarea WordPress po\u021bi consulta articolul <a href=\"https:\/\/www.namebox.ro\/blog\/cum-instalez-wordpress-direct-din-cpanel\/\"><strong>Cum instalez WordPress direct din cPanel?<\/strong><\/a>.<\/p>\n<h2>Ce se \u00eent\u00e2mpl\u0103 dac\u0103 CSP este configurat gre\u0219it?<\/h2>\n<p>S\u0103 presupunem c\u0103 introduci:<\/p>\n<pre>Content-Security-Policy: default-src 'self'<\/pre>\n<p>Aceast\u0103 regul\u0103 poate p\u0103rea sigur\u0103, \u00eens\u0103 un website care folose\u0219te servicii externe poate \u00eencepe imediat s\u0103 aib\u0103 probleme.<\/p>\n<p>Pot fi blocate:<\/p>\n<ul>\n<li>scripturile Google Analytics;<\/li>\n<li>Google Tag Manager;<\/li>\n<li>Google Fonts;<\/li>\n<li>imagini de pe CDN;<\/li>\n<li>iframe-uri YouTube;<\/li>\n<li>reCAPTCHA;<\/li>\n<li>widget-uri externe;<\/li>\n<li>checkout-uri sau componente ale procesatorilor de pl\u0103\u021bi;<\/li>\n<li>request-uri API.<\/li>\n<\/ul>\n<p>Website-ul poate continua s\u0103 afi\u0219eze pagina HTML, dar anumite func\u021bii pot s\u0103 nu mai func\u021bioneze.<\/p>\n<p><strong>Nu rezolva automat problemele CSP ad\u0103ug\u00e2nd * sau &#8216;unsafe-inline&#8217; peste tot.<\/strong> Aceste modific\u0103ri pot reduce semnificativ protec\u021bia pe care CSP ar trebui s\u0103 o ofere.<\/p>\n<h2>Testeaz\u0103 CSP cu Content-Security-Policy-Report-Only<\/h2>\n<p>\u00cenainte s\u0103 aplici o politic\u0103 restrictiv\u0103 este recomandat s\u0103 o testezi.<\/p>\n<p>Pentru aceasta exist\u0103:<\/p>\n<pre>Content-Security-Policy-Report-Only<\/pre>\n<p>\u00cen acest mod browserul poate identifica \u00eenc\u0103lc\u0103rile politicii f\u0103r\u0103 s\u0103 blocheze efectiv resursele.<\/p>\n<p>De exemplu, pentru testare:<\/p>\n<pre>&lt;IfModule mod_headers.c&gt;\r\nHeader always set Content-Security-Policy-Report-Only \"default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: https:; font-src 'self' https:; connect-src 'self'; frame-src 'self'\"\r\n&lt;\/IfModule&gt;<\/pre>\n<p><strong>Acesta este doar un exemplu pentru testare \u0219i nu o politic\u0103 recomandat\u0103 universal.<\/strong><\/p>\n<p>Dup\u0103 activare, deschide:<\/p>\n<p><strong>Developer Tools \u2192 Console<\/strong><\/p>\n<p>\u0219i navigheaz\u0103 prin website.<\/p>\n<p>Browserul poate afi\u0219a resursele care ar fi fost blocate dac\u0103 politica ar fi fost aplicat\u0103 efectiv.<\/p>\n<p>Testeaz\u0103 \u00een special:<\/p>\n<ul>\n<li>homepage-ul;<\/li>\n<li>formularele;<\/li>\n<li>wp-admin;<\/li>\n<li>login-ul;<\/li>\n<li>checkout-ul;<\/li>\n<li>pl\u0103\u021bile;<\/li>\n<li>video-urile;<\/li>\n<li>h\u0103r\u021bile;<\/li>\n<li>reCAPTCHA;<\/li>\n<li>func\u021biile JavaScript;<\/li>\n<li>pagini care comunic\u0103 cu API-uri.<\/li>\n<\/ul>\n<p>Dac\u0103 dore\u0219ti centralizarea automat\u0103 a rapoartelor CSP, trebuie configurat \u0219i un endpoint capabil s\u0103 primeasc\u0103 rapoartele \u00eempreun\u0103 cu mecanismul Reporting API. Nu este suficient s\u0103 introduci o adres\u0103 aleatorie \u00een .htaccess.<\/p>\n<h2>Permissions-Policy<\/h2>\n<p><strong>Permissions-Policy<\/strong> permite controlarea accesului paginii \u0219i al con\u021binutului \u00eencorporat la anumite func\u021bii ale browserului sau dispozitivului.<\/p>\n<p>Printre acestea se num\u0103r\u0103:<\/p>\n<ul>\n<li>camera;<\/li>\n<li>microfonul;<\/li>\n<li>geoloca\u021bia;<\/li>\n<li>anumite func\u021bii asociate dispozitivului.<\/li>\n<\/ul>\n<p>Dac\u0103 website-ul nu are nevoie de camer\u0103, microfon sau geoloca\u021bie, un exemplu este:<\/p>\n<pre>Header always set Permissions-Policy \"camera=(), microphone=(), geolocation=()\"<\/pre>\n<p>Aceast\u0103 configura\u021bie dezactiveaz\u0103 func\u021biile respective.<\/p>\n<p>Nu trebuie \u00eens\u0103 aplicat\u0103 automat.<\/p>\n<p>De exemplu, poate afecta:<\/p>\n<ul>\n<li>un website care permite realizarea unei fotografii cu camera;<\/li>\n<li>o platform\u0103 de videoconferin\u021b\u0103;<\/li>\n<li>o aplica\u021bie care utilizeaz\u0103 microfonul;<\/li>\n<li>un magazin care detecteaz\u0103 loca\u021bia utilizatorului.<\/li>\n<\/ul>\n<p>\u00cen plus, suportul pentru anumite directive Permissions-Policy poate varia \u00eentre browsere, motiv pentru care configura\u021bia trebuie verificat\u0103 \u00eenainte de produc\u021bie.<\/p>\n<h2>Strict-Transport-Security \u2013 HSTS<\/h2>\n<p><strong>Strict-Transport-Security<\/strong>, cunoscut \u0219i ca <strong>HSTS<\/strong>, \u00eei spune browserului c\u0103 website-ul trebuie accesat exclusiv prin HTTPS.<\/p>\n<p>Dup\u0103 ce browserul prime\u0219te politica HSTS printr-o conexiune HTTPS, viitoarele \u00eencerc\u0103ri de acces prin HTTP sunt convertite automat c\u0103tre HTTPS de browser.<\/p>\n<p>Un exemplu este:<\/p>\n<pre>Strict-Transport-Security: max-age=31536000<\/pre>\n<p>Valoarea:<\/p>\n<pre>31536000<\/pre>\n<p>reprezint\u0103 un an \u00een secunde.<\/p>\n<h3>C\u00e2nd poate fi activat HSTS?<\/h3>\n<p>HSTS trebuie analizat doar dup\u0103 ce website-ul func\u021bioneaz\u0103 complet prin HTTPS.<\/p>\n<p>\u00cenainte de activare verific\u0103:<\/p>\n<ul>\n<li>certificatul SSL este valid;<\/li>\n<li>HTTP redirec\u021bioneaz\u0103 c\u0103tre HTTPS;<\/li>\n<li>toate paginile func\u021bioneaz\u0103 prin HTTPS;<\/li>\n<li>nu exist\u0103 probleme Mixed Content importante;<\/li>\n<li>serviciile website-ului nu depind de acces HTTP.<\/li>\n<\/ul>\n<p>Pentru informa\u021bii despre HTTPS po\u021bi consulta pagina de <a href=\"https:\/\/www.namebox.ro\/certificate-ssl\/\"><strong>certificate SSL NameBox<\/strong><\/a> \u0219i articolul despre <a href=\"https:\/\/www.namebox.ro\/blog\/redirect-website-de-la-http-la-https\/\"><strong>redirect HTTP c\u0103tre HTTPS<\/strong><\/a>.<\/p>\n<h3>Testeaz\u0103 HSTS cu un max-age redus<\/h3>\n<p>Dac\u0103 dore\u0219ti s\u0103 testezi HSTS, po\u021bi \u00eencepe cu o perioad\u0103 mai redus\u0103 \u00eenainte de a configura o valoare de un an.<\/p>\n<p>De exemplu:<\/p>\n<pre>&lt;IfModule mod_headers.c&gt;\r\nHeader always set Strict-Transport-Security \"max-age=86400\"\r\n&lt;\/IfModule&gt;<\/pre>\n<p>Aceast\u0103 valoare reprezint\u0103 o zi.<\/p>\n<p>Dup\u0103 ce ai confirmat c\u0103 HTTPS func\u021bioneaz\u0103 corect pentru website, politica poate fi reevaluat\u0103.<\/p>\n<p>Pentru o perioad\u0103 de un an:<\/p>\n<pre>Header always set Strict-Transport-Security \"max-age=31536000\"<\/pre>\n<p>HSTS este luat \u00een considerare de browser numai atunci c\u00e2nd este primit printr-o conexiune HTTPS.<\/p>\n<h3>Ce face includeSubDomains?<\/h3>\n<p>Po\u021bi \u00eent\u00e2lni \u0219i configura\u021bia:<\/p>\n<pre>Header always set Strict-Transport-Security \"max-age=31536000; includeSubDomains\"<\/pre>\n<p><strong>includeSubDomains<\/strong> extinde politica HSTS c\u0103tre subdomenii.<\/p>\n<p>De exemplu, pentru:<\/p>\n<pre>exemplu.ro<\/pre>\n<p>politica poate afecta \u0219i:<\/p>\n<pre>shop.exemplu.ro\r\nmail.exemplu.ro\r\nclient.exemplu.ro\r\napi.exemplu.ro<\/pre>\n<p><strong>Nu activa includeSubDomains dac\u0103 nu e\u0219ti sigur c\u0103 toate subdomeniile sunt \u0219i vor r\u0103m\u00e2ne disponibile prin HTTPS.<\/strong><\/p>\n<p>Un subdomeniu care func\u021bioneaz\u0103 doar prin HTTP poate deveni inaccesibil \u00een browser dup\u0103 aplicarea politicii.<\/p>\n<h3>Ce este HSTS preload?<\/h3>\n<p>Po\u021bi \u00eent\u00e2lni configura\u021bii precum:<\/p>\n<pre>Strict-Transport-Security: max-age=31536000; includeSubDomains; preload<\/pre>\n<p>Preload permite introducerea domeniului \u00eentr-o list\u0103 HSTS distribuit\u0103 direct \u00een browsere.<\/p>\n<p>Astfel, browserul poate \u0219ti c\u0103 domeniul necesit\u0103 HTTPS chiar \u00eenainte de prima conexiune.<\/p>\n<p><strong>Nu recomand\u0103m activarea preload doar pentru a ob\u021bine un scor mai bun \u00eentr-un instrument de testare Security Headers.<\/strong><\/p>\n<p>\u00cenainte de preload trebuie s\u0103 fii sigur c\u0103:<\/p>\n<ul>\n<li>domeniul func\u021bioneaz\u0103 exclusiv prin HTTPS;<\/li>\n<li>toate subdomeniile func\u021bioneaz\u0103 prin HTTPS;<\/li>\n<li>includeSubDomains poate fi activat \u00een siguran\u021b\u0103;<\/li>\n<li>\u00een\u021belegi consecin\u021bele pe termen lung;<\/li>\n<li>infrastructura viitoare va p\u0103stra HTTPS pentru toate hostname-urile afectate.<\/li>\n<\/ul>\n<p>Eliminarea unui domeniu dintr-o list\u0103 preload nu are efect instantaneu \u00een toate browserele. De aceea, preload trebuie tratat ca o decizie important\u0103 de infrastructur\u0103, nu ca o simpl\u0103 linie ad\u0103ugat\u0103 \u00een .htaccess.<\/p>\n<h2>Configura\u021bie .htaccess recomandat\u0103 ca punct de pornire<\/h2>\n<p>Nu recomand\u0103m ad\u0103ugarea tuturor Security Headers \u00eentr-un singur snippet universal.<\/p>\n<p>\u00cemp\u0103r\u021bim configura\u021bia \u00een dou\u0103 categorii.<\/p>\n<h3>A. Headere relativ sigure pentru majoritatea website-urilor<\/h3>\n<p>Acesta poate reprezenta un punct de pornire:<\/p>\n<pre>&lt;IfModule mod_headers.c&gt;\r\n\r\n    # Previne MIME type sniffing\r\n    Header always set X-Content-Type-Options \"nosniff\"\r\n\r\n    # Limiteaz\u0103 afi\u0219area website-ului \u00een iframe-uri\r\n    Header always set X-Frame-Options \"SAMEORIGIN\"\r\n\r\n    # Limiteaz\u0103 informa\u021biile Referer transmise c\u0103tre alte origini\r\n    Header always set Referrer-Policy \"strict-origin-when-cross-origin\"\r\n\r\n&lt;\/IfModule&gt;<\/pre>\n<p>Dup\u0103 ad\u0103ugare, salveaz\u0103 .htaccess \u0219i testeaz\u0103 website-ul.<\/p>\n<h3>B. Headere care trebuie configurate \u0219i testate separat<\/h3>\n<p>Urm\u0103toarele exemple <strong>nu trebuie copiate automat \u00eentr-un website live<\/strong>.<\/p>\n<p><strong>Content-Security-Policy \u2013 testare:<\/strong><\/p>\n<pre>&lt;IfModule mod_headers.c&gt;\r\nHeader always set Content-Security-Policy-Report-Only \"default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: https:; font-src 'self' https:; connect-src 'self'; frame-src 'self'\"\r\n&lt;\/IfModule&gt;<\/pre>\n<p>Dup\u0103 identificarea tuturor resurselor necesare, politica trebuie adaptat\u0103 website-ului \u00eenainte de transformarea ei \u00een:<\/p>\n<pre>Content-Security-Policy<\/pre>\n<p><strong>Permissions-Policy:<\/strong><\/p>\n<pre>&lt;IfModule mod_headers.c&gt;\r\nHeader always set Permissions-Policy \"camera=(), microphone=(), geolocation=()\"\r\n&lt;\/IfModule&gt;<\/pre>\n<p>Folose\u0219te aceast\u0103 configura\u021bie numai dac\u0103 website-ul nu are nevoie de func\u021biile respective.<\/p>\n<p><strong>HSTS pentru testare:<\/strong><\/p>\n<pre>&lt;IfModule mod_headers.c&gt;\r\nHeader always set Strict-Transport-Security \"max-age=86400\"\r\n&lt;\/IfModule&gt;<\/pre>\n<p>Dup\u0103 verificarea complet\u0103 a HTTPS poate fi analizat\u0103 o perioad\u0103 mai mare.<\/p>\n<p><strong>Nu ad\u0103uga includeSubDomains sau preload \u00eenainte s\u0103 verifici toate subdomeniile.<\/strong><\/p>\n<h2>Cum verifici Security Headers dup\u0103 modificare?<\/h2>\n<p>Dup\u0103 salvarea fi\u0219ierului .htaccess verific\u0103 website-ul:<\/p>\n<pre>curl -I https:\/\/exemplu.ro<\/pre>\n<p>Ar trebui s\u0103 vezi, \u00een func\u021bie de configura\u021bia aplicat\u0103:<\/p>\n<pre>x-content-type-options: nosniff\r\nx-frame-options: SAMEORIGIN\r\nreferrer-policy: strict-origin-when-cross-origin<\/pre>\n<p>Dac\u0103 ai configurat \u0219i alte politici:<\/p>\n<pre>content-security-policy-report-only: ...\r\npermissions-policy: ...\r\nstrict-transport-security: ...<\/pre>\n<p>Pentru filtrare rapid\u0103:<\/p>\n<pre>curl -sI https:\/\/exemplu.ro | grep -iE 'content-security|x-frame|x-content-type|referrer-policy|permissions-policy|strict-transport'<\/pre>\n<h2>Testeaz\u0103 mai mult dec\u00e2t homepage-ul<\/h2>\n<p>Faptul c\u0103 homepage-ul se afi\u0219eaz\u0103 corect nu \u00eenseamn\u0103 c\u0103 \u00eentregul website func\u021bioneaz\u0103 dup\u0103 modificarea Security Headers.<\/p>\n<p>Testeaz\u0103 \u0219i:<\/p>\n<ul>\n<li>paginile interne;<\/li>\n<li>formularele de contact;<\/li>\n<li>login-ul;<\/li>\n<li>wp-admin;<\/li>\n<li>Google Maps;<\/li>\n<li>video-urile YouTube;<\/li>\n<li>reCAPTCHA;<\/li>\n<li>Google Analytics;<\/li>\n<li>Tag Manager;<\/li>\n<li>chat-urile externe;<\/li>\n<li>checkout-ul unui magazin online;<\/li>\n<li>procesarea pl\u0103\u021bilor;<\/li>\n<li>API-urile \u0219i AJAX;<\/li>\n<li>fonturile \u0219i imaginile externe.<\/li>\n<\/ul>\n<h2>Verific\u0103 Browser Console dup\u0103 activarea CSP<\/h2>\n<p>Pentru Content Security Policy, unul dintre cele mai utile instrumente este:<\/p>\n<p><strong>Developer Tools \u2192 Console<\/strong><\/p>\n<p>Dac\u0103 o resurs\u0103 este refuzat\u0103 de CSP, browserul poate afi\u0219a un mesaj asem\u0103n\u0103tor cu:<\/p>\n<pre>Refused to load the script because it violates the following Content Security Policy directive...<\/pre>\n<p>Mesajul indic\u0103 de regul\u0103 tipul resursei \u0219i directiva care a provocat problema.<\/p>\n<p>Nu ad\u0103uga domeniul respectiv automat \u00een whitelist. Verific\u0103 mai \u00eent\u00e2i dac\u0103 resursa este legitim\u0103 \u0219i dac\u0103 website-ul are \u00eentr-adev\u0103r nevoie de ea.<\/p>\n<h2>Ce faci dac\u0103 website-ul nu mai func\u021bioneaz\u0103 dup\u0103 modificarea .htaccess?<\/h2>\n<p>Dac\u0103 website-ul afi\u0219eaz\u0103 o eroare imediat dup\u0103 modificare, primul pas este revenirea la configura\u021bia anterioar\u0103.<\/p>\n<p>\u00cenlocuie\u0219te fi\u0219ierul cu backup-ul realizat \u00eenainte:<\/p>\n<pre>.htaccess-backup<\/pre>\n<p>sau elimin\u0103 doar regulile nou ad\u0103ugate.<\/p>\n<p>Dac\u0103 apare o eroare 500, este posibil s\u0103 existe o problem\u0103 de sintax\u0103 \u00een .htaccess.<\/p>\n<p>Dac\u0103 pagina se deschide, dar anumite componente nu func\u021bioneaz\u0103, verific\u0103:<\/p>\n<ul>\n<li>Browser Console;<\/li>\n<li>Network;<\/li>\n<li>Content Security Policy;<\/li>\n<li>iframe-urile;<\/li>\n<li>fonturile;<\/li>\n<li>scripturile externe.<\/li>\n<\/ul>\n<h2>Nu confunda Security Headers cu permisiunile fi\u0219ierelor<\/h2>\n<p>Security Headers \u0219i permisiunile Linux rezolv\u0103 probleme complet diferite.<\/p>\n<p>Headerele HTTP controleaz\u0103 comportamentul browserului, \u00een timp ce permisiunile stabilesc cine poate citi, scrie sau executa fi\u0219iere pe server.<\/p>\n<p>Pentru mai multe informa\u021bii po\u021bi consulta ghidul <a href=\"https:\/\/www.namebox.ro\/blog\/permisiuni-fisiere-cpanel\/\"><strong>Permisiuni fi\u0219iere \u00een cPanel: 644, 755 \u0219i 777<\/strong><\/a>.<\/p>\n<h2>Security Headers nu \u00eenlocuiesc securitatea serverului<\/h2>\n<p>Security Headers pot limita anumite riscuri la nivelul browserului, \u00eens\u0103 nu pot proteja singure un website compromis.<\/p>\n<p>De exemplu, CSP nu \u00eenlocuie\u0219te:<\/p>\n<ul>\n<li>actualizarea WordPress;<\/li>\n<li>actualizarea pluginurilor \u0219i temelor;<\/li>\n<li>ModSecurity;<\/li>\n<li>Imunify360;<\/li>\n<li>parolele puternice;<\/li>\n<li>autentificarea 2FA;<\/li>\n<li>backup-ul;<\/li>\n<li>protec\u021bia accesului SSH sau cPanel.<\/li>\n<\/ul>\n<p>Pe infrastructura NameBox, <strong>LiteSpeed Enterprise<\/strong> este utilizat ca server web, <strong>CloudLinux<\/strong> pentru izolarea \u0219i administrarea resurselor conturilor, iar <strong>Imunify360<\/strong> \u0219i ModSecurity ofer\u0103 niveluri suplimentare de securitate pentru aplica\u021biile web.<\/p>\n<p>Security Headers completeaz\u0103 aceste tehnologii prin reguli aplicate de browser dup\u0103 ce r\u0103spunsul HTTP a fost primit.<\/p>\n<h2>Ai grij\u0103 la headerele configurate \u00een mai multe locuri<\/h2>\n<p>Un website poate avea Security Headers definite din mai multe surse:<\/p>\n<ul>\n<li>.htaccess;<\/li>\n<li>configura\u021bia web serverului;<\/li>\n<li>aplica\u021bia PHP;<\/li>\n<li>un plugin WordPress;<\/li>\n<li>un CDN sau reverse proxy;<\/li>\n<li>o platform\u0103 extern\u0103 precum Cloudflare.<\/li>\n<\/ul>\n<p>Dac\u0103 acela\u0219i header este configurat \u00een mai multe locuri, pot ap\u0103rea valori duplicate sau politici care nu corespund inten\u021biei administratorului.<\/p>\n<p>De aceea, verificarea trebuie realizat\u0103 \u00eentotdeauna pe r\u0103spunsul public final:<\/p>\n<pre>curl -I https:\/\/exemplu.ro<\/pre>\n<p>\u0219i nu doar prin examinarea fi\u0219ierului .htaccess.<\/p>\n<h2>O configura\u021bie mai strict\u0103 nu este automat una mai bun\u0103<\/h2>\n<p>Scopul Security Headers nu este s\u0103 activezi c\u00e2t mai multe reguli doar pentru a ob\u021bine un scor maxim \u00eentr-un scanner online.<\/p>\n<p>O politic\u0103 trebuie s\u0103 protejeze website-ul f\u0103r\u0103 s\u0103 \u00eei afecteze func\u021bionalitatea.<\/p>\n<p>Pentru majoritatea website-urilor po\u021bi \u00eencepe cu:<\/p>\n<pre>X-Content-Type-Options: nosniff\r\nX-Frame-Options: SAMEORIGIN\r\nReferrer-Policy: strict-origin-when-cross-origin<\/pre>\n<p>Apoi analizeaz\u0103 separat dac\u0103 proiectul permite utilizarea:<\/p>\n<ul>\n<li>Content-Security-Policy;<\/li>\n<li>Permissions-Policy;<\/li>\n<li>Strict-Transport-Security.<\/li>\n<\/ul>\n<p>Pentru CSP, \u00eencepe cu <strong>Content-Security-Policy-Report-Only<\/strong>, identific\u0103 toate resursele utilizate \u0219i aplic\u0103 politica numai dup\u0103 testare.<\/p>\n<p>Pentru HSTS, verific\u0103 mai \u00eent\u00e2i c\u0103 HTTPS func\u021bioneaz\u0103 corect pe \u00eentregul website \u0219i trateaz\u0103 <strong>includeSubDomains<\/strong> \u0219i mai ales <strong>preload<\/strong> cu aten\u021bie.<\/p>\n<p>Dac\u0103 utilizezi serviciile de <a href=\"https:\/\/www.namebox.ro\/\"><strong>g\u0103zduire web NameBox<\/strong><\/a>, configura\u021biile .htaccess sunt procesate \u00een mediul cPanel + LiteSpeed, iar Security Headers pot fi aplicate la nivelul website-ului f\u0103r\u0103 modificarea configura\u021biei globale a serverului.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Security Headers sunt headere HTTP trimise de server c\u0103tre browser prin care pot fi definite reguli suplimentare de securitate pentru website. Acestea pot controla, de exemplu, dac\u0103 pagina poate fi \u00eenc\u0103rcat\u0103 \u00eentr-un iframe, din ce surse pot fi \u00eenc\u0103rcate scripturile \u0219i imaginile sau dac\u0103 browserul trebuie s\u0103 foloseasc\u0103 exclusiv HTTPS. Pe un website g\u0103zduit \u00eentr-un &#8230; <a title=\"Security Headers \u00een .htaccess: Cum protejezi un website\" class=\"read-more\" href=\"https:\/\/www.namebox.ro\/blog\/security-headers-htaccess\/\" aria-label=\"Cite\u0219te mai multe despre Security Headers \u00een .htaccess: Cum protejezi un website\">Cite\u0219te mai mult<\/a><\/p>\n","protected":false},"author":8,"featured_media":2449,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[],"class_list":["post-2448","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-securitate"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Security Headers \u00een .htaccess pentru website | NameBox<\/title>\n<meta name=\"description\" content=\"Afl\u0103 ce sunt Security Headers \u0219i cum configurezi X-Frame-Options, CSP, Referrer-Policy, Permissions-Policy \u0219i HSTS prin .htaccess \u00een cPanel.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.namebox.ro\/blog\/security-headers-htaccess\/\" \/>\n<meta property=\"og:locale\" content=\"ro_RO\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Security Headers \u00een .htaccess pentru website | NameBox\" \/>\n<meta property=\"og:description\" content=\"Afl\u0103 ce sunt Security Headers \u0219i cum configurezi X-Frame-Options, CSP, Referrer-Policy, Permissions-Policy \u0219i HSTS prin .htaccess \u00een cPanel.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.namebox.ro\/blog\/security-headers-htaccess\/\" \/>\n<meta property=\"og:site_name\" content=\"NAMEBOX\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/nameboxro\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-02T06:10:12+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-02T06:13:11+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.namebox.ro\/blog\/wp-content\/uploads\/2026\/10\/security-headers-htaccess-cpanel-litespeed.webp.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1479\" \/>\n\t<meta property=\"og:image:height\" content=\"592\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Pop George\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@nameboxro\" \/>\n<meta name=\"twitter:site\" content=\"@nameboxro\" \/>\n<meta name=\"twitter:label1\" content=\"Scris de\" \/>\n\t<meta name=\"twitter:data1\" content=\"Pop George\" \/>\n\t<meta name=\"twitter:label2\" content=\"Timp estimat pentru citire\" \/>\n\t<meta name=\"twitter:data2\" content=\"17 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/security-headers-htaccess\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/security-headers-htaccess\\\/\"},\"author\":{\"name\":\"Pop George\",\"@id\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/#\\\/schema\\\/person\\\/16c3a696f4e4ad7793ae5cb71b24e13d\"},\"headline\":\"Security Headers \u00een .htaccess: Cum protejezi un website\",\"datePublished\":\"2026-10-02T06:10:12+00:00\",\"dateModified\":\"2026-10-02T06:13:11+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/security-headers-htaccess\\\/\"},\"wordCount\":3189,\"publisher\":{\"@id\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/security-headers-htaccess\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/security-headers-htaccess-cpanel-litespeed.webp.jpg\",\"articleSection\":[\"Securitate\"],\"inLanguage\":\"ro-RO\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/security-headers-htaccess\\\/\",\"url\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/security-headers-htaccess\\\/\",\"name\":\"Security Headers \u00een .htaccess pentru website | NameBox\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/security-headers-htaccess\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/security-headers-htaccess\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/security-headers-htaccess-cpanel-litespeed.webp.jpg\",\"datePublished\":\"2026-10-02T06:10:12+00:00\",\"dateModified\":\"2026-10-02T06:13:11+00:00\",\"description\":\"Afl\u0103 ce sunt Security Headers \u0219i cum configurezi X-Frame-Options, CSP, Referrer-Policy, Permissions-Policy \u0219i HSTS prin .htaccess \u00een cPanel.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/security-headers-htaccess\\\/#breadcrumb\"},\"inLanguage\":\"ro-RO\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/security-headers-htaccess\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"ro-RO\",\"@id\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/security-headers-htaccess\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/security-headers-htaccess-cpanel-litespeed.webp.jpg\",\"contentUrl\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/security-headers-htaccess-cpanel-litespeed.webp.jpg\",\"width\":1479,\"height\":592,\"caption\":\"Security Headers configurate prin .htaccess \u00een cPanel \u0219i LiteSpeed\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/security-headers-htaccess\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security Headers \u00een .htaccess: Cum protejezi un website\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/\",\"name\":\"NAMEBOX.RO\",\"description\":\"Ghidul tau complet pentru gazduirea site-urilor web si solutiile de securitate cibernetice\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"ro-RO\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/#organization\",\"name\":\"NAMEBOX SRL\",\"url\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"ro-RO\",\"@id\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/namebox-logo-square.jpg\",\"contentUrl\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/wp-content\\\/uploads\\\/2023\\\/04\\\/namebox-logo-square.jpg\",\"width\":696,\"height\":696,\"caption\":\"NAMEBOX SRL\"},\"image\":{\"@id\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/nameboxro\",\"https:\\\/\\\/x.com\\\/nameboxro\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.namebox.ro\\\/blog\\\/#\\\/schema\\\/person\\\/16c3a696f4e4ad7793ae5cb71b24e13d\",\"name\":\"Pop George\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"ro-RO\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/76911c48cdc44783217d3056a6793dc997179cd7ba76d07382f69207bbf8efac?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/76911c48cdc44783217d3056a6793dc997179cd7ba76d07382f69207bbf8efac?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/76911c48cdc44783217d3056a6793dc997179cd7ba76d07382f69207bbf8efac?s=96&d=mm&r=g\",\"caption\":\"Pop George\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Security Headers \u00een .htaccess pentru website | NameBox","description":"Afl\u0103 ce sunt Security Headers \u0219i cum configurezi X-Frame-Options, CSP, Referrer-Policy, Permissions-Policy \u0219i HSTS prin .htaccess \u00een cPanel.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.namebox.ro\/blog\/security-headers-htaccess\/","og_locale":"ro_RO","og_type":"article","og_title":"Security Headers \u00een .htaccess pentru website | NameBox","og_description":"Afl\u0103 ce sunt Security Headers \u0219i cum configurezi X-Frame-Options, CSP, Referrer-Policy, Permissions-Policy \u0219i HSTS prin .htaccess \u00een cPanel.","og_url":"https:\/\/www.namebox.ro\/blog\/security-headers-htaccess\/","og_site_name":"NAMEBOX","article_publisher":"https:\/\/www.facebook.com\/nameboxro","article_published_time":"2026-10-02T06:10:12+00:00","article_modified_time":"2026-10-02T06:13:11+00:00","og_image":[{"width":1479,"height":592,"url":"https:\/\/www.namebox.ro\/blog\/wp-content\/uploads\/2026\/10\/security-headers-htaccess-cpanel-litespeed.webp.jpg","type":"image\/jpeg"}],"author":"Pop George","twitter_card":"summary_large_image","twitter_creator":"@nameboxro","twitter_site":"@nameboxro","twitter_misc":{"Scris de":"Pop George","Timp estimat pentru citire":"17 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.namebox.ro\/blog\/security-headers-htaccess\/#article","isPartOf":{"@id":"https:\/\/www.namebox.ro\/blog\/security-headers-htaccess\/"},"author":{"name":"Pop George","@id":"https:\/\/www.namebox.ro\/blog\/#\/schema\/person\/16c3a696f4e4ad7793ae5cb71b24e13d"},"headline":"Security Headers \u00een .htaccess: Cum protejezi un website","datePublished":"2026-10-02T06:10:12+00:00","dateModified":"2026-10-02T06:13:11+00:00","mainEntityOfPage":{"@id":"https:\/\/www.namebox.ro\/blog\/security-headers-htaccess\/"},"wordCount":3189,"publisher":{"@id":"https:\/\/www.namebox.ro\/blog\/#organization"},"image":{"@id":"https:\/\/www.namebox.ro\/blog\/security-headers-htaccess\/#primaryimage"},"thumbnailUrl":"https:\/\/www.namebox.ro\/blog\/wp-content\/uploads\/2026\/10\/security-headers-htaccess-cpanel-litespeed.webp.jpg","articleSection":["Securitate"],"inLanguage":"ro-RO"},{"@type":"WebPage","@id":"https:\/\/www.namebox.ro\/blog\/security-headers-htaccess\/","url":"https:\/\/www.namebox.ro\/blog\/security-headers-htaccess\/","name":"Security Headers \u00een .htaccess pentru website | NameBox","isPartOf":{"@id":"https:\/\/www.namebox.ro\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.namebox.ro\/blog\/security-headers-htaccess\/#primaryimage"},"image":{"@id":"https:\/\/www.namebox.ro\/blog\/security-headers-htaccess\/#primaryimage"},"thumbnailUrl":"https:\/\/www.namebox.ro\/blog\/wp-content\/uploads\/2026\/10\/security-headers-htaccess-cpanel-litespeed.webp.jpg","datePublished":"2026-10-02T06:10:12+00:00","dateModified":"2026-10-02T06:13:11+00:00","description":"Afl\u0103 ce sunt Security Headers \u0219i cum configurezi X-Frame-Options, CSP, Referrer-Policy, Permissions-Policy \u0219i HSTS prin .htaccess \u00een cPanel.","breadcrumb":{"@id":"https:\/\/www.namebox.ro\/blog\/security-headers-htaccess\/#breadcrumb"},"inLanguage":"ro-RO","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.namebox.ro\/blog\/security-headers-htaccess\/"]}]},{"@type":"ImageObject","inLanguage":"ro-RO","@id":"https:\/\/www.namebox.ro\/blog\/security-headers-htaccess\/#primaryimage","url":"https:\/\/www.namebox.ro\/blog\/wp-content\/uploads\/2026\/10\/security-headers-htaccess-cpanel-litespeed.webp.jpg","contentUrl":"https:\/\/www.namebox.ro\/blog\/wp-content\/uploads\/2026\/10\/security-headers-htaccess-cpanel-litespeed.webp.jpg","width":1479,"height":592,"caption":"Security Headers configurate prin .htaccess \u00een cPanel \u0219i LiteSpeed"},{"@type":"BreadcrumbList","@id":"https:\/\/www.namebox.ro\/blog\/security-headers-htaccess\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.namebox.ro\/blog\/"},{"@type":"ListItem","position":2,"name":"Security Headers \u00een .htaccess: Cum protejezi un website"}]},{"@type":"WebSite","@id":"https:\/\/www.namebox.ro\/blog\/#website","url":"https:\/\/www.namebox.ro\/blog\/","name":"NAMEBOX.RO","description":"Ghidul tau complet pentru gazduirea site-urilor web si solutiile de securitate cibernetice","publisher":{"@id":"https:\/\/www.namebox.ro\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.namebox.ro\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"ro-RO"},{"@type":"Organization","@id":"https:\/\/www.namebox.ro\/blog\/#organization","name":"NAMEBOX SRL","url":"https:\/\/www.namebox.ro\/blog\/","logo":{"@type":"ImageObject","inLanguage":"ro-RO","@id":"https:\/\/www.namebox.ro\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.namebox.ro\/blog\/wp-content\/uploads\/2023\/04\/namebox-logo-square.jpg","contentUrl":"https:\/\/www.namebox.ro\/blog\/wp-content\/uploads\/2023\/04\/namebox-logo-square.jpg","width":696,"height":696,"caption":"NAMEBOX SRL"},"image":{"@id":"https:\/\/www.namebox.ro\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/nameboxro","https:\/\/x.com\/nameboxro"]},{"@type":"Person","@id":"https:\/\/www.namebox.ro\/blog\/#\/schema\/person\/16c3a696f4e4ad7793ae5cb71b24e13d","name":"Pop George","image":{"@type":"ImageObject","inLanguage":"ro-RO","@id":"https:\/\/secure.gravatar.com\/avatar\/76911c48cdc44783217d3056a6793dc997179cd7ba76d07382f69207bbf8efac?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/76911c48cdc44783217d3056a6793dc997179cd7ba76d07382f69207bbf8efac?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/76911c48cdc44783217d3056a6793dc997179cd7ba76d07382f69207bbf8efac?s=96&d=mm&r=g","caption":"Pop George"}}]}},"_links":{"self":[{"href":"https:\/\/www.namebox.ro\/blog\/wp-json\/wp\/v2\/posts\/2448","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.namebox.ro\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.namebox.ro\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.namebox.ro\/blog\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.namebox.ro\/blog\/wp-json\/wp\/v2\/comments?post=2448"}],"version-history":[{"count":2,"href":"https:\/\/www.namebox.ro\/blog\/wp-json\/wp\/v2\/posts\/2448\/revisions"}],"predecessor-version":[{"id":2451,"href":"https:\/\/www.namebox.ro\/blog\/wp-json\/wp\/v2\/posts\/2448\/revisions\/2451"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.namebox.ro\/blog\/wp-json\/wp\/v2\/media\/2449"}],"wp:attachment":[{"href":"https:\/\/www.namebox.ro\/blog\/wp-json\/wp\/v2\/media?parent=2448"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.namebox.ro\/blog\/wp-json\/wp\/v2\/categories?post=2448"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.namebox.ro\/blog\/wp-json\/wp\/v2\/tags?post=2448"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}