Add CSP to htaccess

January 8, 2025 · AI Conversations

User

place attached in .htaccess file

Assistant

To place the configuration from the image into your `.htaccess` file, follow these steps:

1. **Access Your `.htaccess` File:**
– Locate the `.htaccess` file in the root directory of your website. If you don't see it, ensure your file manager or editor shows hidden files.

2. **Edit the `.htaccess` File:**
– Open the file in a text editor and add the following line (replace the placeholder `configuration` with the full policy shown in the green box in the image):

Header add Content-Security-Policy-Report-Only "default-src * 'unsafe-inline' 'unsafe-eval'; style-src 'unsafe-inline'; script-src 'none' 'report-sample'; connect-src 'none'; form-action 'none'; frame-src 'none'; worker-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests; block-all-mixed-content; report-uri https://csp.threatview.app/report;"

3. **Save Changes:**
– Save the file and upload it back to the server if you edited it locally.

4. **Test the Configuration:**
– Visit your website to ensure it works as expected. Use browser developer tools to verify the `Content-Security-Policy-Report-Only` header is applied.

5. **Monitor Reports:**
– Reports will be sent to the URL specified in the `report-uri` directive (`https://csp.threatview.app/report` in this case).

Let me know if you need assistance with any specific part of the process!

User

# BEGIN W3404

RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule (.*)/w3-cache/(css|js)/(d)*(.*)[mob]*.(css|js) $4.$5 [L]

# END W3404
#BEGIN Really Simple SSL LETS ENCRYPT
RewriteRule ^.well-known/(.*)$ – [L]
#END Really Simple SSL LETS ENCRYPT

# BEGIN W3Gzip

AddType x-font/woff .woff
AddType x-font/ttf .ttf
AddOutputFilterByType DEFLATE image/svg+xml
AddOutputFilterByType DEFLATE text/plain
AddOutputFilterByType DEFLATE text/html
AddOutputFilterByType DEFLATE text/xml
AddOutputFilterByType DEFLATE text/css
AddOutputFilterByType DEFLATE text/javascript
AddOutputFilterByType DEFLATE application/xml
AddOutputFilterByType DEFLATE application/xhtml+xml
AddOutputFilterByType DEFLATE application/rss+xml
AddOutputFilterByType DEFLATE application/javascript
AddOutputFilterByType DEFLATE application/x-javascript
AddOutputFilterByType DEFLATE application/x-font-ttf
AddOutputFilterByType DEFLATE x-font/ttf
AddOutputFilterByType DEFLATE application/vnd.ms-fontobject
AddOutputFilterByType DEFLATE font/opentype font/ttf font/eot font/otf

# END W3Gzip
# BEGIN W3LBC

AddType application/font-woff2 .woff2
AddType application/x-font-opentype .otf
ExpiresActive On
ExpiresDefault A0
ExpiresByType video/webm A10368000
ExpiresByType video/ogg A10368000
ExpiresByType video/mp4 A10368000
ExpiresByType image/webp A10368000
ExpiresByType image/gif A10368000
ExpiresByType image/png A10368000
ExpiresByType image/jpg A10368000
ExpiresByType image/jpeg A10368000
ExpiresByType image/ico A10368000
ExpiresByType image/svg+xml A10368000
ExpiresByType text/css A10368000
ExpiresByType text/javascript A10368000
ExpiresByType application/javascript A10368000
ExpiresByType application/x-javascript A10368000
ExpiresByType application/font-woff2 A10368000
ExpiresByType application/x-font-opentype A10368000
ExpiresByType application/x-font-truetype A10368000

Header set Expires "max-age=A10368000, public"
Header unset ETag
Header set Connection keep-alive
FileETag None

# END W3LBC
# Blocked by Ric

order deny,allow
deny from all

Header Set Strict-Transport-Security: max-age=10886400;
# BEGIN WordPress
# The directives (lines) between "BEGIN WordPress" and "END WordPress" are
# dynamically generated, and should only be modified via WordPress filters.
# Any changes to the directives between these markers will be overwritten.

RewriteEngine On
RewriteRule .* – [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index.php$ – [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

# END WordPress
#for etag configuration
#https://tipsnfreeware.com/how-to-configure-entity-tags-etags/
Header unset Etag
FileETag none

# BEGIN cPanel-generated php ini directives, do not edit
# Manual editing of this file may result in unexpected behavior.
# To make changes to this file, use the cPanel MultiPHP INI Editor (Home >> Software >> MultiPHP INI Editor)
# For more information, read our documentation (https://go.cpanel.net/EA4ModifyINI)

php_flag display_errors Off
php_value max_execution_time 60
php_value max_input_time 60
php_value max_input_vars 1000
php_value memory_limit 128M
php_value post_max_size 8M
php_value session.gc_maxlifetime 1440
php_value session.save_path "/var/cpanel/php/sessions/ea-php74"
php_value upload_max_filesize 2M
php_flag zlib.output_compression Off

# END cPanel-generated php ini directives, do not edit

# php — BEGIN cPanel-generated handler, do not edit
# Set the “ea-php74” package as the default “PHP” programming language.

# Set X-Frame-Options to prevent clickjacking attacks
Header always append X-Frame-Options "SAMEORIGIN"

# Enable XSS protection
Header always set X-XSS-Protection "1; mode=block"

# Prevent MIME type sniffing
Header always set X-Content-Type-Options "nosniff"

Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"

Header set Referrer-Policy "strict-origin-when-cross-origin"

Header set Permissions-Policy "geolocation=self"

AddHandler application/x-httpd-ea-php74 .php .php7 .phtml

Require all denied

# php — END cPanel-generated handler, do not edit
add in this

Assistant

To add the `Content-Security-Policy-Report-Only` header configuration to your `.htaccess` file, you can follow these steps:

1. Open your `.htaccess` file in a text editor.

2. Add the following configuration near the top or in the relevant section for headers:

# BEGIN Content Security Policy Report Only
   <IfModule mod_headers.c>
       Header add Content-Security-Policy-Report-Only "default-src * 'unsafe-inline' 'unsafe-eval'; style-src 'unsafe-inline'; script-src 'none' 'report-sample'; connect-src 'none'; form-action 'none'; frame-src 'none'; worker-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests; block-all-mixed-content; report-uri https://csp.threatview.app/report;"
   </IfModule>
   # END Content Security Policy Report Only

3. Save the `.htaccess` file and upload it to your server if necessary.

4. Test the configuration to ensure it is applied correctly:
– Open your website in a browser.
– Use browser developer tools (usually accessible with `F12`) to inspect the response headers in the "Network" tab.
– Look for the `Content-Security-Policy-Report-Only` header to confirm it is set.

This setup will not block any content but will log violations to the specified `report-uri`. If you face any issues or need further assistance, let me know!

Add CSP to htaccess

Leave a Comment Cancel