apache_conf FD站点安全htaccess条目

Posted 2021-05-23

Header set Strict-Transport-Security "max-age=31536000" env=HTTPS
Header set X-Frame-Options DENY

# prevent mime based attacks
Header set X-XSS-Protection "1; mode=block"
Header always append X-Frame-Options SAMEORIGIN
Header set X-Content-Type-Options: "nosniff"

Header set Content-Security-Policy "default-src 'self'  *.boldchat.com; script-src 'self' 'unsafe-inline' 'unsafe-eval' seal.verisign.com livechat.boldchat.com sadmin.brightcove.com vmss.boldchat.com vms.boldchat.com www.googletagmanager.com www.google-analytics.com ajax.googleapis.com netdna.bootstrapcdn.com tags.tiqcdn.com; font-src 'self' netdna.bootstrapcdn.com; connect-src 'self'; img-src 'self' *.boldchat.com seal.verisign.com seal.websecurity.norton.com www.google-analytics.com firstdatapartners.122.2o7.net; style-src 'self' netdna.bootstrapcdn.com 'unsafe-inline';"