二级c评分

Our main focus today is on existing threats affecting your company or individual website. Threats we know of and ignore and threats we don’t. Let’s now dive into it, describe, discuss and curb the threats. Grab your riding gear and let’s start!

Ø乌尔今天主要关注的是影响你的公司或个人网站存在的威胁。 我们知道和忽略的威胁以及我们所不知道的威胁。 现在让我们深入研究，描述，讨论和遏制威胁。 拿起您的骑行装备，开始吧！

We will concentrate more on Apache web server and how we can achieve our main goal of fixing the existing security issues that are affecting your website security score.

我们将更加专注于Apache Web服务器，以及如何实现解决影响您网站安全评分的现有安全问题的主要目标。

目录清单 (Directory Listing)

Did you know that anyone around the globe could easily browse the content of your directories(folders) if no index is found? Well, now you know. Anyone cross-referencing with existing known vulnerabilities could easily come into contact with the term “index of” and easily get into the server and download your files.

您是否知道，如果找不到索引，全球任何人都可以轻松浏览目录(文件夹)的内容？ 好吧，现在你知道了。 任何与现有已知漏洞进行交叉引用的人都可以很容易地与“索引”一词联系起来，并轻松进入服务器并下载文件。

Tip! (according to mother Google, an index is another name for the database used by a search engine. Indexes contain the information on all the websites that Google (or any other search engine) was able to find. If a website is not in a search engine’s index, users will not be able to find it.)

小费！ (根据Google的母版， 索引是搜索引擎使用的数据库的另一个名称。索引包含Google (或任何其他搜索引擎)能够找到的所有网站上的信息。如果某个网站不在搜索中引擎的索引 ，用户将无法找到它。)

So, how do we disable this? Well, first you have to log in to your cPanel and go to your public_html folder to locate your .htaccess file. Ones you’ve located it, do make sure to first make a backup of it by right clicking, chosen compress option and downloading the backup in case just in case to be safe. After doing so, now it’s time to edit out the .htaccess file by still right clicking and choosing the edit option. Now add the following line of code at the end of you the existing lines.

那么，如何禁用此功能？ 好吧，首先，您必须登录到cPanel并转到public_html文件夹以找到您的.htaccess文件。 找到它的人，请确保首先通过右键单击，选择压缩选项并下载备份来备份它，以防万一以防万一。 这样做之后，现在是时候通过右键单击并选择编辑选项来编辑.htaccess文件了。 现在，在现有行的末尾添加以下代码行。

# 
Options -Indexes

a snap of the .htaccess file directory showing the code snippet .htaccess文件目录的快照，显示代码片段

That’s all you have to do to disable directory listing. Cheers!

这就是禁用目录列表所要做的全部。 干杯!

X-XSS(跨站点脚本)保护 (X-XSS(Cross-Site-Scripting) Protection)

Hackers can easily inject malicious executable scripts into the code of a trusted application or website. Attackers often initiate an XSS attack by sending malicious links to users and entice them to click the link(s). If the app or website lacks proper data sanitization, the malicious link executes the attacker’s chosen code on the user’s system. As a result, the attacker can steal the user’s active session cookie.

黑客可以轻松地将恶意的可执行脚本注入受信任的应用程序或网站的代码中。 攻击者通常通过向用户发送恶意链接并诱使他们单击链接来发起XSS攻击。 如果应用程序或网站缺乏适当的数据清理功能，则恶意链接会在用户的系统上执行攻击者选择的代码。 结果，攻击者可以窃取用户的活动会话cookie。

Tip! (A Hacker is a person who finds and exploits the weakness in computer systems and/or networks to gain access. There are three types of hackers, namely “White hat hackers, grey hat hackers and black hat hackers. Learn more about them to understand the difference in them)So how do we protect ourselves from X-XSS injection attacks? Well, all you have to do is add the below code and you could be one step ahead to protecting your users.

小费！ (黑客是发现并利用计算机系统和/或网络中的弱点来获取访问权限的人。黑客共有三种类型，即“白帽黑客，灰帽黑客和黑帽黑客。了解有关它们的更多信息以了解它们。那么它们之间的差异)那么我们如何保护自己免受X-XSS注入攻击呢？ 好吧，您所要做的就是添加以下代码，您可能就可以保护用户了。

# security headers
<IfModule mod_headers.c>
	Header set X-XSS-Protection "1; mode=block"
</IfModule>

X框架选项 (X-Frame-Options)

According to mozilla developers, the X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a <frame> , <iframe> , <embed> or <object> . Sites can use this to avoid click-jacking attacks, by ensuring that their content is not embedded into other sites.

根据mozilla开发人员， X - Frame - Options HTTP响应标头可用于指示是否应允许浏览器在< frame >，<iframe>，<embed>或<object>中呈现页面。 网站可以通过确保其内容未嵌入其他网站来避免点击劫持攻击。

To protect ourselves against this, append the below code just after Header set X-XSS-Protection… code before the closing tag(<IfModule>)

为了防止这种情况的发生，请在Header设置X-XSS-Protection…代码之后，在结束标记(<IfModule>)之前附加以下代码

Header set X-Frame-Options "SAMEORIGIN"

X内容类型选项 (X-Content-Type-Options)

Protects against MIME-type sniffing exploits. It does this by disabling the browser’s MIME sniffing feature, and forcing it to recognize the MIME type sent by the server.

防止MIME类型的嗅探攻击。 为此，它禁用浏览器的MIME嗅探功能，并强制其识别服务器发送的MIME类型。

To protect ourselves against this, append the below code just after Header set X-XSS-Frame-Options… code just before the closing tag(<IfModule>)

为了防止这种情况的发生，请在Header设置X-XSS-Frame-Options…代码之后紧接结束标记(<IfModule>)之前添加以下代码

Header set X-Content-Type-Options "nosniff"

功能政策 (Feature-Policy)

According to OWASP, Feature Policy Header is an added layer of security that helps to restrict from unauthorized access or usage of browser/client features by web resources. This policy ensures the user privacy by limiting or specifying the features of the browsers can be used by the web resources. Feature Policy provides a set of standard HTTP headers that allow website owners to limit which features of browsers can be used by the page such as camera, microphone, location, full screen etc.

根据OWASP，功能策略标头是安全性的附加层，有助于限制Web资源禁止未经授权访问或使用浏览器/客户端功能。 此策略通过限制或指定Web资源可以使用的浏览器功能来确保用户隐私。 功能策略提供了一组标准的HTTP标头，这些标头允许网站所有者限制页面可以使用的浏览器功能，例如摄像头，麦克风，位置，全屏等。

Again, to protect ourselves against this, append the below code just after Header set X-Content-Type-Options… code just before the closing tag(<IfModule>)

同样，为了防止这种情况的发生，请在Header设置X-Content-Type-Options…代码之后紧接结束标记(<IfModule>)之前添加以下代码

Header set Feature-Policy "geolocation 'self'; vibrate 'none'"

The code instructs supportive browsers to enable only geo-location and vibrate features.

该代码指示支持性浏览器仅启用地理位置和振动功能。

内容安全政策 (Content-Security-Policy)

Commonly know as the CSP, it’s an extra security layer that helps protect against malicious injection of JavaScript, CSS, plugins, and more.

通常称为CSP，它是一个额外的安全层，有助于防止恶意注入JavaScript，CSS，插件等。

To protect ourselves against this, you append the protection as shown in the below sample code just after Header set Feature-Policy code just before the closing tag(<IfModule>)

为了防止这种情况的发生，您可以在Header设置Feature-Policy代码之后，在结束标记(<IfModule>)之前，添加以下示例代码中所示的保护

Header set Content-Security-Policy "default-src https:; font-src https: data:; img-src https: data:; script-src https:; style-src https:;"

Append the above code if your site tends to use the same types of resources, so as to keep things clean and simple.

如果您的站点倾向于使用相同类型的资源，请附加上面的代码，以使事情保持简洁。

In a few Mins We’ve gone from this 在几分钟内，我们已经摆脱了 To This Score 达到这个分数

完整摘要： (Full Snippet:)

# security-Protection
<IfModule mod_headers.c>
 Header set X-XSS-Protection "1; mode=block"
 Header set X-Frame-Options "SAMEORIGIN"
    Header set X-Content-Type-Options "nosniff"
    Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains"
    Header set Feature-Policy "geolocation 'self'; vibrate 'none'"
</IfModule>

If I’ve left out something you think we should add, feel free to let me know. Cheers! 🍻

如果我遗漏了一些您认为我们应该添加的内容，请随时告诉我。 干杯! 🍻

翻译自: https://medium.com/swlh/scoring-a-clean-a-security-score-in-your-website-4037b8cac702

二级c评分