Zurgl.com Website Review

header always set Strict-Transport-Security “max-age=31536000; includeSubdomains; preload” Enforces HTTPS on the entire site. Don’t use if you still need to provide HTTP, of course. header always set X-Content-Type-Options nosniff Prevents browsers from trying to “guess” MIME types and such, header always set X-Xss-Protection “1; mode=block” Activates cross-scripting (XSS) protection in browsers. header always set Referrer-Policy “unsafe-url” Makes the site always send referrer information to other sites. NOTE: this is not the most secure setting, but it’s the one I prefer; see below. header always set Content-Security-Policy “default-src https: data: ‘unsafe-inline’ ‘unsafe-eval'” Forces TLS (don’t use if you still need to provide HTTP); prevents mixed content warnings. NOTE: again, this is not the most I choose to send referring information to other sites for a simple reason: I like to see where my own visitors come from (I don’t sell, share or monetize that in any way, it’s just for curiosity’s sake), and I’m a firm believer in treating others as I want to be treated. If you don’t care about that, you may want to change this to “no-referrer-when-downgrade“, or “strict-origin“. As for the Content Security Policy, anything more “secure” than the above prevents (or at least makes it a lot more headache-inducing) every external domain to a list of exceptions), and a lot of hacking on software such as WordPress (seriously: add the setting, but then developed, mostly static site, but I fail to see the point. So, this and the paragraph above are the reasons for an A rating, instead of an January 10th, 2019, but this shouldn’t change for any other 7.x versions of either CentOS or RHCE). And we’ll keep firewalld and ones I’ve worked at) it’s, typically, official policy to disable both.