FeedDiscussion
Hey! It doesn't really matter how and where you set the header, as long as it is correctly returned to the web browser.
If you're using Apache, you can use mod_headers like so:
Header set Strict-Transport-Security "options"
httpd.apache.org/docs/current/mod/mod_headers.html
Not really related to HSTS, but since you are already using Apache then check out ModSecurity and the OWASP Core Ruleset as well, it will provide you a WAF (Web Application Firewall) capability to your Apache server and protect your PHP application from most obviously malicious input.
mahesh sabharwal
Thanks for the article. But this article as well as others I have seen on the web - miss out one critical thing - where do I add these directives?
You mention that add this directive -
Strict-Transport-Security: max-age=60Ya, but where?
I am using Ubuntu 16.04 with Apache, MySQL and PHP.