How to enable Content-Security-Policy and Permissions-Policy Apache headers

Question

How to enable Content-Security-Policy and Permissions-Policy Apache headers for all websites?

Answer

You may want to enable the Content-Security-Policy and Permissions-Policy headers to increase site security. This article provides the procedure to add these headers to the Apache configuration.

Note: The following instructions assume you already enabled HSTS on the server.

1. Log into WHM as the root user.
2. Navigate to WHM / Service Configuration / Apache Configuration
3. Use the Include Editor
4. Under the Pre-Main Include section, select "All Versions" from the drop-down menu.

5. Add the following entries:

   CONFIG_TEXT: <If "%{HTTP_HOST} !~ /^(webmail|cpanel|whm)\./i">
          Header always set Content-Security-Policy "default-src 'self'; font-src *;img-src * data:; script-src *; style-src *;"
          Header always set Permissions-Policy "geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()"
   </If>

6. Click the Update button, then the Restart Apache button to apply the configuration.

Additional resource

PCI - How to enable HSTS on a cPanel server.

Apache Configuration

Include Editor