最近給學校做網站，被查出各種響應頭缺失的 低危漏洞 和 一些配置漏洞，還有一些需要https的配置。。。。。
php.ini 中修改
expose_php off // php彩蛋信息泄露
session.cookie_httponly=true // cookie沒有設置httponly屬性
PHP 配置
header("X-Frame-Options:SAMEORIGIN;"); // X-Frame-Options 響應頭缺失
header("Referer-Policy:origin;");//Referer-Policy 響應頭缺失
header("Content-Security-Policy:frame-ancestors 'self';");//Content-Security-Policy 響應頭缺失
header("X-Permitted-Cross-Domain-Policies:'master-only';");//X-Permitted-Cross-Domain-Policies 響應頭缺失
header("X-XSS-Protection:1; mode=block;");//X-XSS-Protection 響應頭缺失
header("X-Download-Options: SAMEORIGIN;");//X-Download-Options 響應頭缺失
header("X-Content-Type-Options:nosniff;");//X-Content-Type-Options 響應頭缺失
header("Strict-Transport-Security:max-age=31536000;");//Strict-Transport-Security 響應頭缺失
Nginx 配置
add_header X-Frame-Options SAMEORIGIN;
add_header Referer-Policy origin;
add_header Content-Security-Policy "frame-ancestors 'self'";
add_header X-Permitted-Cross-Domain-Policies "master-only";
add_header X-XSS-Protection "1; mode=block;";
add_header X-Download-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;
add_header Strict-Transport-Security max-age=31536000;