Enable Security HTTP Headers

[Nirjonadda]

We want Enable Security HTTP Headers. Does correct location is "Pre Main Include" or "Pre VirtualHost Include" section in "WHM >> Home >> Service Configuration >> Apache Configuration" ?

Does this correct rules for Apache Configuration?

# Enable Support Forward Secrecy
SSLHonorCipherOrder On
SSLProtocol all -SSLv2 -SSLv3

# Security header Enable HSTS
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" env=HTTPS

# Turn on IE8-IE9 XSS prevention tools X-XSS
Header always set X-XSS-Protection "1; mode=block"

# Referrer-Policy
Header always set Referrer-Policy "no-referrer-when-downgrade"

# X-Permitted-Cross-Domain-Policies
Header always set X-Permitted-Cross-Domain-Policies "none"

 

[cPanelMichael]

Hello,

There's a thread on this topic at:

SOLVED - Auto Force TLS

Let us know if this helps.
https://documentation.cpanel.net/display/EA4/Modify+Apache+Virtual+Hosts+with+Include+Files
Thank you.