Magento 2 Security Headers: Control HSTS, CSP and Frame Protection in the Admin
SKU: SECURITYHEADERS1
- HSTS, X-Frame-Options, nosniff, referrer and permissions policy in the admin
- Content-Security-Policy in report-only mode with a report log
- IP-based test mode and a master switch for instant rollback
- Header overview with a duplicate note, setting per store view
Einmaliger Kauf · inkl. 12 Monate Updates · zzgl. MwSt.
Magento 2 Security Headers: HTTP protection from the admin instead of the server configuration
With Magento 2 Security Headers from Mironsoft you set the most important HTTP security headers of your shop in the admin: HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and a Content-Security-Policy in report-only mode. Every setting applies per store view, a test mode shows the effect before anything is blocked, and an overview lists the headers actually delivered. The module needs no intervention in nginx or Apache and works independently of the frontend, Hyvä or not.
Configurable HSTS
Strict-Transport-Security with max-age, includeSubDomains and a preload option, delivered over HTTPS only.
Clickjacking protection
X-Frame-Options or frame-ancestors, optionally Deny, Same Origin or your own list of allowed domains.
Referrer and permissions policy
Referrer-Policy and Permissions-Policy with selection lists so camera, location and microphone run only where you allow it.
CSP in report-only mode
Content-Security-Policy-Report-Only collects violations in a log without blocking the shop.
Test mode
New headers can first be served only to certain IP addresses and withdrawn again with a switch.
Header overview
An admin page fetches the home page and shows which headers really arrive, including a note on duplicates.
Why Magento 2 Security Headers are a must-have building block of shop security
Security headers instruct the browser to load pages only over HTTPS, not to be embedded in foreign frames and not to misinterpret content. They cost no performance and protect against whole classes of attacks such as clickjacking or protocol downgrade. Yet they are missing in many shops because they have to be configured in the web server or at the CDN and nobody is responsible. Merchants therefore search for Magento 2 security headers, Magento 2 enable HSTS or Magento 2 content security policy setup.
With Magento 2 Security Headers all values sit in one place in the admin, changeable per store view and secured by a test mode. That lets even a team without server access roll out improvements traceably. Protection against attacks remains part of your overall strategy; the headers replace neither updates nor server hardening.
HSTS and transport protection with Magento 2 Security Headers
With HSTS the browser remembers that your shop is reachable only over HTTPS. In the admin you set the validity in seconds, decide on subdomains and preload, and start with a short value until all pages run cleanly over HTTPS. The module delivers the header only on HTTPS responses because on HTTP it would be ineffective. A notice warns when preload is selected but subdomains are not included, because preload lists reject that combination.
- max-age, includeSubDomains and preload
- Delivery over HTTPS only
- Warning for an unsuitable preload combination
Controlling clickjacking, MIME sniffing and referrer with Magento 2 Security Headers
X-Frame-Options or the more modern frame-ancestors directive prevent third parties from loading your shop in an invisible frame. If you want to allow certain partner sites, you enter them in a list. X-Content-Type-Options prevents the browser from interpreting files differently from their declaration, and the Referrer-Policy limits how much of the calling address is sent to external sites. The Permissions-Policy switches off browser features such as camera or location for your pages in a targeted way.
- Frame protection with a list of allowed domains
- nosniff and Referrer-Policy by selection
- Permissions-Policy for camera, location, microphone
Introducing a Content-Security-Policy safely in report-only mode with Magento 2 Security Headers
A Content-Security-Policy is powerful but risky: a rule that is too strict blocks scripts from payment providers or analytics tools. That is why the module starts in report-only mode. The browser reports violations to an endpoint in your shop without blocking anything. In the admin you see the reports grouped by directive and source and can take over a source into your list of allowed sources with one click. Only when the reports are quiet do you switch to enforcing.
- Report-only with endpoint and log
- Reports grouped by directive and source
- Take over sources by click, enforce only afterwards
Test mode, header overview and rollback in Magento 2 Security Headers
In test mode the module serves new headers only to defined IP addresses, so you can check the behaviour in the live shop without affecting customers. The header overview fetches your home page and shows which headers really arrive, even when the web server or CDN sets additional values. Duplicate or contradictory headers are marked. A master switch withdraws all headers at once, without a deployment.
- Test mode by IP address
- Overview of delivered headers with a duplicate note
- Master switch for immediate rollback
Where Magento 2 Security Headers helps in everyday shop life
Typical situations in which Magento 2 Security Headers make the difference.
Security review and audit
Auditors or corporate customers ask for documented headers. With Magento 2 Security Headers the configuration sits traceably in the admin.
Several store views
Different domains need different frame lists and sources without every domain requiring its own server configuration.
Shop behind a CDN or proxy
The overview shows what finally arrives and uncovers headers that are set twice.
Gradual rollout
With report-only and test mode, stricter rules are introduced without disturbing payment or tracking.
Magento 2 Security Headers: without and with the module
The difference between Magento 2 Security Headers and configuration in the web server.
| Topic | Without module | With Mironsoft Security Headers |
|---|---|---|
| Where configured | Nginx, Apache or CDN | Admin, per store view |
| Responsibility | Server admin or agency | Also without server access |
| Safeguards | Live at once, errors visible to everyone | Test mode by IP and report-only |
| Control | Check with an external tool | Overview in the admin with duplicate note |
| Rollback | Change configuration, restart | One switch, immediately |
How we set up Magento 2 Security Headers for you
The process after you place the order.
Inventory
Before Magento 2 Security Headers we check which headers web server, CDN and Magento already set, and which scripts and services your shop embeds.
Installation
We install the module and set up Magento 2 Security Headers for your store views with cautious starting values.
Test phase
We activate the test mode and the CSP in report-only mode and evaluate the reports together with you.
Hardening
We take over legitimate sources, raise the HSTS duration and switch the policy to enforcing if needed.
Handover
Your team gets an introduction to overview, reports and rollback.
Differentiation from Security Suite and Magento built-ins
The Security Suite from Mironsoft protects the admin area: login limiting, IP blocks, logs and two-factor sign-in. Magento 2 Security Headers instead acts on the HTTP responses of the shop and thus on the behaviour of your visitors' browsers. The two complement each other but do not replace each other.
Newer Magento versions ship their own Content-Security-Policy configuration. The module supplements it with an understandable interface, reports and a test mode and takes care not to deliver contradictory values. There is no guarantee of particular ratings in external scanning tools or of complete security; overall responsibility remains with the shop operator.
No download — personal setup instead
Security Headers is not listed here as a ready-made download file for self-installation. The purchase is a service commission: we get in touch after the purchase, install the module in your shop and agree on headers, test phase and source lists together with you.
Frequently asked questions
Everything important about Magento 2 Security Headers, CSP, test mode and the purchase process.
How can I enable HSTS in Magento 2?
How can I set up a Content-Security-Policy in Magento 2?
Can security headers break my shop?
How do I see which headers are really delivered?
Can I set different headers per store view?
What happens if my web server already sets headers?
Does Magento 2 Security Headers work with Hyvä and payment providers?
Are security headers a replacement for updates and server hardening?
Does the module guarantee top grades in security scanners?
Can I download and install the module myself?
Recently Viewed Products
Magento 2 Security Headers – Mironsoft