Description

Ensure each static site sets security response headers on all paths (/*), including Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, and X-Content-Type-Options, using Render's custom response headers.

Rationale

Security headers tell browsers to use HTTPS only, block the site from being framed by other sites, stop content type guessing, and limit which scripts can run. Without them, visitors are more exposed to clickjacking, content injection, and protocol downgrade attacks.

Impact

  • Visitors are protected from clickjacking and content injection

  • Browsers are told to always use HTTPS

  • A strict Content-Security-Policy may need tuning so the site still works

Default Value

By default, Render does not add these custom security headers to static sites.

Pre-Requisites

  • Admin or Developer role on the static site

Remediation

Test Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. From your workspace home (or project), click the static site to open it.

  3. Open the static site's Headers page from the left pane and review the header rules for the /* path (which matches all request paths).

  4. Alternatively, run: curl -I https://<your-site> and check the response headers.

  5. If any of the four headers is missing, follow the implementation steps.

Implementation Steps

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. From your workspace home (or project), click the static site to open it.

  3. Open the static site's Headers page from the left pane and add rules for the path /* with these headers (each rule has a path, a name, and a value): Strict-Transport-Security (for example max-age=31536000; includeSubDomains), Content-Security-Policy (for example default-src 'self'), X-Frame-Options (DENY or SAMEORIGIN), and X-Content-Type-Options (nosniff).

  4. Save the changes and test the site to confirm it still works.

  5. If the site is managed by a Blueprint, add the same rules under headers in render.yaml.

Backout Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. From your workspace home (or project), click the static site to open it.

  3. Open the Headers page and remove or edit the header rules.

Reference