# HTTP Security Headers

**URL:** <https://forum.pritunl.com/t/http-security-headers/1903>\
**Category:** Pritunl Zero\
**Tags:** pritunl-zero\
**Created:** [March 13, 2024, 2:21am UTC](https://forum.pritunl.com/t/http-security-headers/1903 "2024-03-13T02:21:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ponlayookm](https://forum.pritunl.com/user_avatar/forum.pritunl.com/ponlayookm/32/689_2.png) [@ponlayookm](https://forum.pritunl.com/u/ponlayookm)\
**Post date:** [March 13, 2024, 2:21am UTC](https://forum.pritunl.com/t/http-security-headers/1903/1 "2024-03-13T02:21:57Z")

</div>

Hi Pritunl Team,  
While implementing Pritunl Zero, our compliance team has notified us  
the following risk alerts from [securityscorecard.com](http://securityscorecard.com) regarding Pritunl Zero’s webUI:

- Website Does Not Implement HSTS Best Practices
- Website does not implement X-Content-Type-Options Best Practices
- Site Does Not Use Best Practices Against Embedding of Malicious Content

Thus result in overall score deduction and affect our compliance policy.  
Is there some ways to be able to add these HTTP Security Headers:

- Strict-Transport-Security
- X-Frame-Options
- X-Content-Type-Options
- Referrer-Policy

Applying these will promptly elevate Pritunl zero’s score on [securityscorecard.com](http://securityscorecard.com), and granting us better compliance for our customers.

Kindly advice. Thank you.

---

<div class="post-metadata">

**Author:** ![zach](https://forum.pritunl.com/user_avatar/forum.pritunl.com/zach/32/1105_2.png) [@zach](https://forum.pritunl.com/u/zach)\
**Post date:** [March 14, 2024, 4:47pm UTC](https://forum.pritunl.com/t/http-security-headers/1903/2 "2024-03-14T16:47:52Z")

</div>

Using HSTS would block access to the web console if the certificate is ever expired or configured incorrectly. Domain matching is used so it can’t be overridden by using an IP address.

I have enabled some of the other headers and this will be included in the next release. These were first tested in Pritunl Cloud but never copied over to Pritunl Zero.

There is a CSRF token implemented for both the web console and on top of any web services but the backend web service will need to configure any headers. These headers would only be configured for the user and admin web console.

---

<div class="post-metadata">

**Author:** ![ponlayookm](https://forum.pritunl.com/user_avatar/forum.pritunl.com/ponlayookm/32/689_2.png) [@ponlayookm](https://forum.pritunl.com/u/ponlayookm)\
**Post date:** [March 26, 2024, 7:47am UTC](https://forum.pritunl.com/t/http-security-headers/1903/3 "2024-03-26T07:47:47Z")

</div>

Sorry for the late reply. Thank you very much.  
Looking forward to the next release.

Cheers,