Overview #
ProVide lets administrators add any custom HTTP response headers to the built-in web interface and to the admin interface independently. Custom headers let you tailor the server to your organisation’s policies — most commonly to strengthen browser-side security (framing control, content security policy, referrer handling) or to control search-engine indexing.
Where to configure #
Headers are defined in the Settings.ini file in C:\Program Files\ProVide, under two sections: [HTTP custom headers] for the regular built-in web interface and [HTTPS Admin custom headers] for the separate admin interface. Add as many lines as you like under the relevant section — one double-quoted line per header.
[HTTP custom headers] "Content-Security-Policy: default-src 'self'; frame-ancestors 'self'" "Referrer-Policy: strict-origin-when-cross-origin"
Controlling whether your site can be framed #
To stop other sites embedding ProVide in an <iframe> (clickjacking protection), use either the legacy header or — preferably — the modern CSP frame-ancestors directive, which is fully supported by current browsers:
"X-Frame-Options: SAMEORIGIN" "Content-Security-Policy: frame-ancestors 'self'"
frame-ancestors 'self' allows only your own origin (equivalent to SAMEORIGIN); frame-ancestors 'none' blocks all framing (equivalent to DENY); and frame-ancestors https://portal.example.com allows a specific site — the working replacement for the deprecated X-Frame-Options: ALLOW-FROM, which current browsers ignore.
Keeping your site out of search engines #
"X-Robots-Tag: noindex"
Recommended security headers #
- Content-Security-Policy — the primary defence against content injection. A policy that works with ProVide’s interface (which uses inline styles) is shown below.
- Strict-Transport-Security — for HTTPS deployments, e.g.
max-age=31536000; includeSubDomains. - Referrer-Policy — e.g.
strict-origin-when-cross-origin. - X-Frame-Options — framing control for older clients, alongside CSP
frame-ancestors.
"Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; object-src 'none'; frame-ancestors 'self'; base-uri 'self'; form-action 'self'"
ProVide already sends X-Content-Type-Options: nosniff on every response, so you do not need to add that one. The example policy allows 'unsafe-inline' for styles only, because the interface uses inline styles; scripts stay restricted to 'self'.
References #
- Content-Security-Policy — developer.mozilla.org/en-US/docs/Web/HTTP/CSP
- Strict-Transport-Security — developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
- X-Frame-Options — developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
- Referrer-Policy — developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
