Enabling Security Headers

Security headers are response headers set by the WAF that tell browsers which behaviors to allow on your site. They are off by default.

To turn them on, use the Force Security Headers toggle on the Content Security page of your WAF dashboard (Advanced plan or above). One toggle enables three headers together:

• X-XSS-Protection helps prevent cross-site scripting attacks
• X-Frame-Options prevents other sites from loading your pages inside iframes, a technique used in clickjacking and phishing attempts
• X-Content-Type-Options prevents MIME-based content attacks

For the full picture, including Strict-Transport-Security (HSTS), Referrer-Policy, and which headers belong in your application instead, see Managing HTTP Security Headers.