Resolved How to add response headers to the port 8443?

[Alex Bosch]

Server operating system version

Debian 9.13

Plesk version and microupdate number

Obsidian 18.0.44

Hi;

I use a subdomain as a hostname and I set the access to the plesk interface with it. I managed to add http security headers when accessing to plesk with the subdomain URL, with the help of this article:

Resolved - How can I adjust HSTS in Plesk?

But when I try to access to plesk via subdomain:8443, the http security headers disappear.

I do not use nginx. I set them on apache.

Could you please help me to solve that?

Thank you in advance

 

[Peter Debik]

The port 8443 is not serviced by Nginx, nor Apache. It is serviced by an additional web server that is customized specifically for the Plesk control panel pages. Please do not try to mess with configuration files for these, it will only cause problems, because there are a huge number of dependencies between PHP, the Plesk-owned web server and its configuration.

If you believe that HSTS is needed for the panel pages, please vote for the feature request here:

Enable OCSP stapling ans HSTS for Plesk panel

OSCP stapling and HSTS can now be enabled for domains using SSL It! estension. However these settings cannot be enabled while securing Plesk panel. So it will be really appreciated if such functionality is included in future Plesk updates.

plesk.uservoice.com

 

[Alex Bosch]

Hi, @Peter Debik

Thank you for your answer. I don't know how, but HSTS it is already applied on the 8443 port URL, but not other security headers that are needed. I don't want to mess, but without these headers, Security Scorecard and other security checkers flag my server with security problems, which is true.

If some headers are already applied on port 8443 URL (HSTS, X-XXS and X-frame), others should. I only need to know how to do that.

Thank you.

 

[Alex Bosch]

I already solved that with the help of this article:

https://support.plesk.com/hc/en-us/articles/360016977493-How-to-add-headers-to-a-Plesk-page-

Yesterday I tried it but failed because a lack of a ;

Now it is working!