Operational Web Security Plan

Priority: HIGH | Timeline: Day 1-2 | Owner: DevOps Lead

Description:

Add X-Frame-Options header to web server configuration to protect against clickjacking attacks.

Nginx/LiteSpeed Solution:

server {
    # Add to server configuration
    add_header X-Frame-Options "DENY" always;
    
    # Alternative SAMEORIGIN option
    # add_header X-Frame-Options "SAMEORIGIN" always;
}

Staging Verification:

• Deploy configuration to staging server
• Verify header: curl -I https://staging.example.com
• Confirm: X-Frame-Options: DENY returned
• Test all endpoints

Production Deployment:

1. Backup current config: cp nginx.conf nginx.conf.backup
2. Update production configuration
3. Reload server: systemctl reload nginx (zero downtime)
4. Verify production: curl -I https://example.com
5. Document change in changelog

Rollback (if needed):

cp nginx.conf.backup nginx.conf
systemctl reload nginx

Priority: HIGH | Timeline: Day 3-5 | Owner: Infrastructure Lead

Description:

Current SSL certificate does not match domain name. Obtain and install correct certificate for example.com.

Cloudflare Process:

1. Navigate to Cloudflare Dashboard → SSL/TLS
2. Click "Generate certificate" for example.com
3. Select "Comodo/Universal" certificate type
4. Wait for validation (~5 minutes)
5. Copy certificate and key to server
6. Update Nginx configuration

Nginx Configuration Update:

server {
    listen 443 ssl http2;
    server_name example.com www.example.com;
    
    # Update certificate paths
    ssl_certificate /etc/ssl/certs/example.com.crt;
    ssl_certificate_key /etc/ssl/private/example.com.key;
    
    # Recommended SSL parameters
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
}

Verification:

• Check certificate: openssl s_client -connect example.com:443
• Verify CN = example.com (not cdnjs.cloudflare.com)
• Check expiration date
• Open in browser - verify no warnings
• Check SSL Report: https://www.ssllabs.com/

Priority: MEDIUM | Timeline: Day 5-7 | Owner: DevOps + Security

Complete Security Header Set:

server {
    # Clickjacking protection
    add_header X-Frame-Options "DENY" always;
    
    # MIME type detection prevention
    add_header X-Content-Type-Options "nosniff" always;
    
    # XSS protection
    add_header X-XSS-Protection "1; mode=block" always;
    
    # Referrer policy
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    
    # Feature/Permissions policy
    add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;
    
    # HSTS
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
}

Testing:

• Verify all headers: curl -I https://example.com
• Confirm all 6 headers present
• Check HSTS preload: https://hstspreload.org
• Full application functional testing