We have an issue on our server when our Security Headers are not working. We added the following to our htaccess file after installing Craft CMS: -
<IfModule mod_headers.c> Header always set X-Xss-Protection "1; mode=block" Header always set X-Content-Type-Options "nosniff" Header always append X-Frame-Options ALLOWALL Header always set Strict-Transport-Security "max-age=31536000" Header always set Referrer-Policy no-referrer </IfModule>
These settings worked on our previous CMS which was completely developed in house. We have recently upgraded our server to PHP 7 and Apache 2.4. We have been using https://securityheaders.io to check our results.
Any help trying to get this to work would be really appreciated.