Enterprise Solution: Adding and Setting Up Security Headers
Security headers are a set of instructions or rules configured to your website or web server, that fortify websites against cyber threats, protecting sensitive data and fostering site visitor trust.
With Wix Studio for enterprise, you can add and configure your organization's custom security headers for each site. You can also duplicate security header policies across sites to speed up securing your organization's online assets.
Important:
Security headers work on an individual site level, not on an account level. This allows you to choose the relevant security headers for each of the organization's sites.
Custom security header types
The following security headers are currently available with Wix Studio for enterprise:
Permissions-Policy
Enables web developers to control which web platform features are available to a web page, enhancing security and privacy by limiting access to sensitive APIs. Learn more about Permissions-Policy headers.
X-Frame-Options
Determines if a webpage can be displayed within a frame, preventing clickjacking attacks by restricting framing. Learn more about X-Frame-Options.
Referrer-Policy
Specifies how much information should be included in the HTTP referrer header when navigating from one page to another, enhancing user privacy and reducing data leakage. Learn more about Referrer-Policy headers.
Strict-Transport-Security (HSTS)
Forces secure HTTPS connections, protecting against man-in-the-middle attacks by ensuring all communication between browser and server occurs over HTTPS. Learn more about Strict-Transport-Security (HSTS) headers.
Content-Security-Policy (CSP)
Controls which resources a web page is allowed to load, mitigating risks such as cross-site scripting (XSS) attacks and data injection. Learn more about Content-Security-Policy (CSP) headers.
X-Content-Type-Options
Note: This security header is supported by default on all Wix sites.
Tells the browser to use the Multipurpose Internet Mail Extensions (MIME) content type. This is a way of identifying the format of a file or document specified by the server, and not to change it. This helps prevent MIME type sniffing, ensuring the content type is used exactly as intended. Learn more about X-Content-Type-Options.
Adding and configuring security headers
Add and configure the relevant custom security headers for your organization's sites to protect against cyberattacks. Add, and then configure each security header before saving and testing on your site. After a successful test, you can then activate your custom security headers.
Important:
Only click Save at the top when you are finished configuring all the relevant headers, or you will have to start again from scratch.
To add security headers to a site:
Go to Security Headers in your enterprise dashboard.
Click + Add Headers at the top right.
Click the relevant site.
Click Select.
Select the checkbox next to the security headers you want to add and configure.
Configure the relevant security headers according to your needs, following the instructions below:
Permissions-Policy
The Permissions-Policy header enables your organization's web developers to specify which website functionalities are permitted or restricted. You can define a set of policies that control access to APIs and browser behaviors. This ensures your site adheres to best practices and facilitates safer integration of third-party content.
To configure your Permissions-Policy custom header:
Assemble the relevant directives and their corresponding allowlists, separating each with a comma, as shown in the example above.
Copy and paste your directives into the Directives field under Permissions-Policy.
X-Frame-Options
Note: The Content-Security-Policy HTTP header has a frame-ancestors directive, which renders this header obsolete for supporting browsers.
The X-Frame-Options HTTP response header determines whether a browser can display a page within a frame, iframe, embed, or object, serving as a defense against clickjacking attacks, though it's effective only when the user's browser supports X-Frame-Options.
To configure your X-Frame-Options custom security header:
Click to expand the Directive drop-down under X-Frame-Options.
Choose the relevant option: Deny or Same-origin.
Referrer-Policy
The Referrer-Policy HTTP header dictates the level of referrer information sent with requests via the Referrer header, and this policy can also be specified in HTML.
To configure your Referrer-Policy custom security header:
Click to expand the Directive drop-down.
Choose the relevant option from the drop-down.
Strict-Transport-Security (HSTS)
The HTTP Strict-Transport-Security (HSTS) response header instructs browsers to access the site exclusively through HTTPS, automatically converting any HTTP attempts to HTTPS.
To configure your Strict-Transport-Security (HSTS) custom security header:
Enter the max-age, specifying the duration in seconds. For example: max-age=63072000
(Optional) Select the includeSubDomains checkbox.
(Optional) Select the preload checkbox.
Note: When using preload, the max-age directive must be at least 31536000 (1 year), and the includeSubDomains directive checkbox must be enabled.
Content-Security-Policy (CSP)
Content Security Policy (CSP) provides extra protection by identifying and preventing specific types of attacks, such as Cross-Site Scripting (XSS) and data injection. These attacks can lead to various harmful actions, from stealing data to distributing malware or defacing websites.
To configure your Content-Security-Policy (CSP):
Enter all relevant directives and their corresponding values in the Directives field.
Deactivating security headers
You can temporarily deactivate a security header on a site if your organization is making changes to the site and you need to test certain features. However, it's crucial to reactivate the security header afterward to maintain protection against cyber threats.
To deactivate a security header:
Go to Security Headers in your enterprise dashboard.
Click the More Actions icon
next to the security header you want to deactivate on a site.
Click Deactivate.
Click Deactivate again to confirm.
Deleting security headers
You can delete any security header policy on any of your sites at any time.
Important:
Deleting a policy is permanent and you cannot undo this action. You can deactivate a policy instead, if you prefer.
To remove a security header from a site:
Go to Security Headers in your enterprise dashboard.
Click the More Actions icon
next to the security header you want to remove from a site.
Click Delete.
Click Delete Policy to confirm.
Granting access to manage security headers
By default, only an account owner and co-owner can add, set up and manage security headers. You can, however, create a custom role for your account to grant security header access to your security manager, for example.
To grant access to manage security headers:
Go to Team in your enterprise dashboard.
Click More Actions at the top.
Click Manage Roles.
Click + Create New Role.
Enter the Role Title and Description.
Scroll down, and click to expand Sites.
Select the Manage Folders checkbox.
Scroll down, and click to expand Enterprise Dashboard.
Select the Manage Security Headers checkbox.
Click Save.
