Google has released a security update for Chrome, urging web developers to implement a nosniff response header to help mitigate potential hacks via web browsers. This is relevant for SEOs, web developers, designers, and site publishers.
Importance of the Security Update
The Spectre and Meltdown attacks exploit vulnerabilities in a user’s device to steal sensitive data like passwords, posing a user experience challenge.
Overview of the Chrome Update
Chrome has been updated to version 67, introducing Site Isolation, a feature designed to protect site visitors’ browsers from attacks. This feature prevents untrustworthy websites from accessing or stealing information from accounts on other sites by isolating pages from different websites into separate processes.
Recommendations from Google
Google’s Chrome team advises developers and publishers to take the following steps to optimize the efficiency of Site Isolation:
- Ensure resources have the correct “Content-Type” response headers.
- Serve resources with a nosniff response header.
Nosniff Response Header
The nosniff response header enhances a website’s security by preventing browsers like Google Chrome and Internet Explorer from adjusting the content-type based on the server’s declaration. Chrome’s automated process defends against Spectre and Meltdown, but Google recommends explicitly using the nosniff header for better protection.
Implementing the Nosniff Response Header
Start by checking your security headers. Tools are available to scan websites for missing security headers. If needed, use htaccess to implement a nosniff response header.
Htaccess code for nosniff response header:
<ifmodule mod_headers.c="">
Header set X-Content-Type-Options nosniff
</ifmodule>Adding Nosniff Header on WordPress
For WordPress users, several plugins can add crucial security headers, including nosniff. The plugins include Security Headers, HTTP Headers to Improve Security, and HTTP Headers, each offering various features for security enhancement.
Warning: While more popular plugins are often preferred, high installation numbers and ratings do not guarantee a bug-free experience. Exercise caution when installing plugins.
Note: If using W3 Total Cache, remember to clear your cache after updating plugin settings for changes to take effect.
Conclusion: Importance of Security Response Headers
Even without Google Chrome’s prompt, incorporating security response headers like nosniff is a good practice for site protection.
Images by Shutterstock, Modified by Author
