Administration: Configure the HTTP response headers

Sitefinity CMS come with a set of predefined headers. You can configure them separately and you can turn them on and off separately.

To configure the security headers, perform the following:

1. In Sitefinity CMS backend, navigate to Administration » Settings » Advanced.
2. In the tree on the left, expand WebSecurity » HttpSecurityHeaders » ResponseHeaders.
   A list of the predefined headers appear.
3. Click the header that you want to configure.
4. Edit the Http header value input field or select Disable checkbox.

   NOTE: You can globally disable all security headers, by navigation to Administration » Settings » Advanced » WebSecurity » HttpSecurityHeaders and selecting Disable sending security headers in the http response checkbox. We do not recommend using this option.

5. Save your changes.

For more information about the headers, see Predefined security headers in HTTP response

NOTE: There are headers that support reporting. If you want to turn on the Content-Security-Policy-Report-Only or the Public-Key-Pins -Report-Only headers, you must disable the Content-Security-Policy and the Public-Key-Pins headers, respectively.
For more information, see Administration: Configure reporting.