SSL 100% A+ rating van alle SSL checkers
Om een 100% A+ score te halen moet je onderstaande regels zetten in:
/etc/letsencrypt/options-ssl-apache.conf
Je snapt dat dit elke file kan zijn die je maar wil als je em maar include..
Let's go!
sudo nano /etc/letsencrypt/options-ssl-apache.conf
SSLEngine on
SSLHonorCipherOrder On
SSLCompression off
SSLUseStapling On
SSLCipherSuite HIGH:!RSA:!CAMELLIA:!AES128
SSLProtocol TLSv1.2
SSLOpenSSLConfCmd ECDHParameters secp384r1
SSLOpenSSLConfCmd Curves secp521r1:secp384r1
SSLSessionTickets Off
SSLStaplingResponderTimeout 5
SSLStaplingReturnResponderErrors off
Protocols h2 http:/1.1
RequestHeader set X-HTTPS 1
Header always set Strict-Transport-Security 'max-age=63072000; includeSubDomains; preload'
Header always set X-Frame-Options SAMEORIGIN
Header always set X-Content-Type-Options nosniff
Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
Header always set X-Xss-Protection '1; mode=block'
Header always set Referrer-Policy 'no-referrer'
#Kijk uit met deze settings of je website nog wel werkt!
Header always set Content-Security-Policy
default-src 'none';
media-src 'none';
object-src 'none';
font-src 'none';
frame-ancestors 'none';
form-action 'none';
manifest-src 'self';
img-src data: https:;
base-uri https://www.computerbas.nl;
style-src https://www.computerbas.nl;
frame-src https://gadgets.buienradar.nl;
connect-src https://www.googletagmanager.com https://www.google-analytics.com;
script-src https://www.computerbas.nl https://www.google-analytics.com https://www.googletagmanager.com;
block-all-mixed-content;
upgrade-insecure-requests;
#Deze nog effe niet:
#
#disown-opener;
#prefetch-src;
#reflected-xss filter;
#sandbox allow-forms allow-same-origin allow-scripts allow-top-navigation allow-popups allow-pointer-lock;
#plugin-types;
#worker-src;
#navigate-to;
#require-sri-for script style;
#report-to;
#
#Deze niet meer:
#child-src
#report-uri
#referrer
Laatst gewijzigd op 03/12/2019
