header di sicurezza

Buongiorno, ho inserito gli header di sicurezza nel mio sito nel file .htaccess, ma non funzionano, sapete perché?
Nel sito è attivo cloudflare

il mio htaccess:

Codice:

# BEGIN WpFastestCache # Modified Time: 03-08-22 3:06:58 <IfModule mod_rewrite.c> RewriteEngine On RewriteBase / RewriteCond %{HTTPS} =on RewriteCond %{HTTP_HOST} ^lucafornaciarifotografie.altervista.org # Start WPFC Exclude # End WPFC Exclude # Start_WPFC_Exclude_Admin_Cookie RewriteCond %{HTTP:Cookie} !wordpress_logged_in_[^\=]+\=Luca # End_WPFC_Exclude_Admin_Cookie RewriteCond %{HTTP_HOST} ^lucafornaciarifotografie.altervista.org RewriteCond %{HTTP_USER_AGENT} !(facebookexternalhit|WP_FASTEST_CACHE_CSS_VALIDATOR|Twitterbot|LinkedInBot|WhatsApp|Mediatoolkitbot) RewriteCond %{HTTP_USER_AGENT} !(WP\sFastest\sCache\sPreload(\siPhone\sMobile)?\s*Bot) RewriteCond %{REQUEST_METHOD} !POST RewriteCond %{REQUEST_URI} !(\/){2}$ RewriteCond %{REQUEST_URI} \/$ RewriteCond %{QUERY_STRING} !.+ RewriteCond %{HTTP:Cookie} !comment_author_ RewriteCond %{HTTP:Cookie} !safirmobilswitcher=mobil RewriteCond %{HTTP:Profile} !^[a-z0-9\"]+ [NC] RewriteCond %{HTTP_USER_AGENT} !^.*\bCrMo\b|CriOS|Android.*Chrome\/[.0-9]*\s(Mobile)?|\bDolfin\b|Opera.*Mini|Opera.*Mobi|Android.*Opera|Mobile.*OPR\/[0-9.]+|Coast\/[0-9.]+|Skyfire|Mobile\sSafari\/[.0-9]*\sEdge|IEMobile|MSIEMobile|fennec|firefox.*maemo|(Mobile|Tablet).*Firefox|Firefox.*Mobile|FxiOS|bolt|teashark|Blazer|Version.*Mobile.*Safari|Safari.*Mobile|MobileSafari|Tizen|UC.*Browser|UCWEB|baiduboxapp|baidubrowser|DiigoBrowser|Puffin|\bMercury\b|Obigo|NF-Browser|NokiaBrowser|OviBrowser|OneBrowser|TwonkyBeamBrowser|SEMC.*Browser|FlyFlow|Minimo|NetFront|Novarra-Vision|MQQBrowser|MicroMessenger|Android.*PaleMoon|Mobile.*PaleMoon|Android|blackberry|\bBB10\b|rim\stablet\sos|PalmOS|avantgo|blazer|elaine|hiptop|palm|plucker|xiino|Symbian|SymbOS|Series60|Series40|SYB-[0-9]+|\bS60\b|Windows\sCE.*(PPC|Smartphone|Mobile|[0-9]{3}x[0-9]{3})|Window\sMobile|Windows\sPhone\s[0-9.]+|WCE;|Windows\sPhone\s10.0|Windows\sPhone\s8.1|Windows\sPhone\s8.0|Windows\sPhone\sOS|XBLWP7|ZuneWP7|Windows\sNT\s6\.[23]\;\sARM\;|\biPhone.*Mobile|\biPod|\biPad|Apple-iPhone7C2|MeeGo|Maemo|J2ME\/|\bMIDP\b|\bCLDC\b|webOS|hpwOS|\bBada\b|BREW.*$ [NC] RewriteCond %{DOCUMENT_ROOT}/wp-content/cache/all/$1/index.html -f [or] RewriteCond /membri/lucafornaciarifotografie/wp-content/cache/all/$1/index.html -f RewriteRule ^(.*) "/wp-content/cache/all/$1/index.html" [L] </IfModule> <FilesMatch "index\.(html|htm)$"> AddDefaultCharset UTF-8 <ifModule mod_headers.c> FileETag None Header unset ETag Header set Cache-Control "max-age=0, no-cache, no-store, must-revalidate" Header set Pragma "no-cache" Header set Expires "Mon, 29 Oct 1923 20:30:00 GMT" </ifModule> </FilesMatch> # END WpFastestCache # BEGIN GzipWpFastestCache <IfModule mod_deflate.c> AddType x-font/woff .woff AddType x-font/ttf .ttf AddOutputFilterByType DEFLATE image/svg+xml AddOutputFilterByType DEFLATE text/plain AddOutputFilterByType DEFLATE text/html AddOutputFilterByType DEFLATE text/xml AddOutputFilterByType DEFLATE text/css AddOutputFilterByType DEFLATE text/javascript AddOutputFilterByType DEFLATE application/xml AddOutputFilterByType DEFLATE application/xhtml+xml AddOutputFilterByType DEFLATE application/rss+xml AddOutputFilterByType DEFLATE application/javascript AddOutputFilterByType DEFLATE application/x-javascript AddOutputFilterByType DEFLATE application/x-font-ttf AddOutputFilterByType DEFLATE x-font/ttf AddOutputFilterByType DEFLATE application/vnd.ms-fontobject AddOutputFilterByType DEFLATE font/opentype font/ttf font/eot font/otf </IfModule> # END GzipWpFastestCache # BEGIN LBCWpFastestCache <FilesMatch "\.(webm|ogg|mp4|ico|pdf|flv|avif|jpg|jpeg|png|gif|webp|js|css|swf|x-html|css|xml|js|woff|woff2|otf|ttf|svg|eot)(\.gz)?$"> <IfModule mod_expires.c> AddType application/font-woff2 .woff2 AddType application/x-font-opentype .otf ExpiresActive On ExpiresDefault A0 ExpiresByType video/webm A10368000 ExpiresByType video/ogg A10368000 ExpiresByType video/mp4 A10368000 ExpiresByType image/avif A10368000 ExpiresByType image/webp A10368000 ExpiresByType image/gif A10368000 ExpiresByType image/png A10368000 ExpiresByType image/jpg A10368000 ExpiresByType image/jpeg A10368000 ExpiresByType image/ico A10368000 ExpiresByType image/svg+xml A10368000 ExpiresByType text/css A10368000 ExpiresByType text/javascript A10368000 ExpiresByType application/javascript A10368000 ExpiresByType application/x-javascript A10368000 ExpiresByType application/font-woff2 A10368000 ExpiresByType application/x-font-opentype A10368000 ExpiresByType application/x-font-truetype A10368000 </IfModule> <IfModule mod_headers.c> Header set Expires "max-age=A10368000, public" Header unset ETag Header set Connection keep-alive FileETag None </IfModule> </FilesMatch> # END LBCWpFastestCache # BEGIN WordPress # Le direttive (linee) tra `BEGIN WordPress` e `END WordPress` sono # generate dinamicamente, e dovrebbero essere modificate solo tramite i filtri di WordPress. # Ogni modifica alle direttive tra questi marcatori verrÃƒÆ’Ã†â€™Ãƒâ€*Ã¢â‚¬â„¢ÃƒÆ’Ã¢â‚¬Â*ÃƒÂ¢Ã¢â€šÂ¬Ã¢â€žÂ¢ÃƒÆ’Ã†â€™ÃƒÂ¢Ã¢â€šÂ¬Ã…Â¡ÃƒÆ’Ã¢â‚¬Å¡Ãƒâ€šÃ‚Â* sovrascritta. <IfModule mod_rewrite.c> RewriteEngine On RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] RewriteBase / RewriteRule ^index\.php$ - [L] RewriteCond %{REQUEST_FILENAME} !-f RewriteCond %{REQUEST_FILENAME} !-d RewriteRule . /index.php [L] </IfModule> # END WordPress # # av:php5-engine AddHandler av-php8 .php # Security Headers <IfModule mod_headers.c> Header set X-XSS-Protection "1; mode=block" Header set X-Frame-Options "SAMEORIGIN" Header set Expect-CT "max-age=304800, enforce" Header set X-Content-Type-Options "nosniff" Header always set Strict-Transport-Security "max-age=31588000; includeSubDomains" # Header set Content-Security-Policy ... Header set Referrer-Policy "same-origin" Header set Feature-Policy "geolocation 'self'" </IfModule>

Quali sono questi header? Intendi quelli per bloccare l'XSS?
Come mai vuoi inserire questi header? Come verifichi il funzionamento?

Ciao!

La verifica la fa Site Health di WP dopo aver installato Really Simple SSL, o altrimenti puoi usare questo sito: https://securityheaders.com/

Il codice è quello che puoi leggere alla fine <code># Security Headers
<IfModule mod_headers.c>
Header set X-XSS-Protection "1; mode=block"
Header set X-Frame-Options "SAMEORIGIN"
Header set Expect-CT "max-age=304800, enforce"
Header set X-Content-Type-Options "nosniff"
Header always set Strict-Transport-Security "max-age=31588000; includeSubDomains"
# Header set Content-Security-Policy ...
Header set Referrer-Policy "same-origin"
Header set Feature-Policy "geolocation 'self'"
</IfModule></code>

è sbagliato?

Le direttive attualmente disponibili sono quelle indicate qui.

Pertanto le direttive di mod_headers non possono essere impostate da .htaccess, ma solo da PHP.

Ciao!