SSL + HSTS + X-Frame-Options

Postby wrapmetightly » Sat Jan 04, 2014 2:58 pm

Hey :) I've been having a lot of fun here...

It would be really nice to have a bit more basic security on the site.

I would suggest doing full-time SSL + HSTS + X-Frame-Options, which would do a bit to protect the members' privacy and keep malicious scripters at bay.

You can get a good enough certificate for free or close to it these days. Not sure about your web host or phpBB, but I can do a bit more research if you're interested.

If you want to chat web security, send me a pm! :shock:

Thanks for an awesome site. :)

Re: SSL + HSTS + X-Frame-Options

Postby xtc » Sat Jan 04, 2014 3:04 pm

wrapmetightly wrote:I would suggest doing full-time SSL + HSTS + X-Frame-Options, which would do a bit to protect the members' privacy and keep malicious scripters at bay.


Forgive my ignorance but does this come with an English trnslation?
Boxer shorts are cool,
but little speedos rule!

More by the same author: viewtopic.php?f=5&t=22729

Re: SSL + HSTS + X-Frame-Options

Postby wrapmetightly » Sat Jan 04, 2014 3:31 pm

No problem! I’ll do a quick summary!

SSL - This is the lock icon in your browser. It means information is encrypted between you and your server, and helps keep people from snooping. You have to get a certificate (but it’s free these days) and get your host to help you set it up.

HSTS - This is a header you can add to your site that tells browsers, “everything from here should be encrypted.” It helps privacy by keeping things like cookies from leaking to third parties. https://developer.mozilla.org/en-US/doc ... t_Security

X-Frame-Options - This is another header that tells the browser never to put your site in a frame. It helps prevent some cross-site-scripting attacks, clickjacking, and all sort of other fun stuff. There might be a button for this in phpBB already. https://developer.mozilla.org/en-US/doc ... me-Options

None of this stuff is critical, at all. But if you’ve been paying attention to the stuff advertisers and ISP and governments have been doing to snoop on you online, it feels like we should make an effort. Especially considering the personal nature of the content here.

Cheers :D

Re: SSL + HSTS + X-Frame-Options

Postby xtc » Sat Jan 04, 2014 4:03 pm

Thanks for the attempt. I understand some of it.
Boxer shorts are cool,
but little speedos rule!

More by the same author: viewtopic.php?f=5&t=22729