Red Zone Area

X-Frame-Options: deny | sameorigin | allow-from url

• deny: This directive stops the site from being rendered in <frame> i.e. site can’t be embedded into other sites.
• sameorigin: This directive allows the page to be rendered in the frame iff frame has the same origin as the page.
• allow-from uri:  This directive has now became obsolete and shouldn’t be used. It is not  supported by modern browser. In this the page can be rendered in the <frame> that is originated from specified uri.

 Header always set X-Frame-Options "sameorigin"

 Open httpd.conf file and add the following code to deny the permission

 Header always set x-frame-options "DENY"

 add_header x-frame-options "SAMEORIGIN" always;

X-XSS-Protection: 0 | 1 | 1;mode=block | 1;report=<reporting url>

Header set X-XSS-Protection "1; mode=block"

add_header "X-XSS-Protection" "1; mode=block";

Set-Cookie: <cookie-name>=<cookie-value> | Expires=<date> 
						               | Max-Age=<non-zero-digit> | Domain=<domain-value>
						               | Path=<path-value> | SameSite=Strict|Lax|none

• <cookie-name>=<cookie-value>: The cookie name have to avoid this character ( ) @, ; : \ ” / [ ] ? = { } plus control characters, spaces, and tabs. It can be any US-ASCII characters.
• Expires=<date>: It is an optional directive that contains the expiry date of the cookie.
• Max-Age=<non-zero-digit>: It contains the life span in a digit of seconds format, zero or negative value will make the cookie expired immediately.
• Domain=<domain-value>: This directive defines the host where the cookie will be sent. It is an optional directive.
• Path=<path-value>: This directive define a path that must exist in the requested URL, else the browser can’t send the cookie header.
• SameSite=Strict|Lax|none: This directives providing some protection against cross-site request forgery attacks.