Quick Answer
How do you add security headers to a BizStackPro funnel or website?
Open Sites, select your funnel or website, open Settings → Security, and click Add New Security Header. Enter the header name and value, save the change, and test the live page before adding another header.
What Security Headers Do
Security headers are instructions sent with a page response that tell the visitor’s browser how certain content and security controls should be handled.
Properly configured headers can help reduce risks such as cross-site scripting, clickjacking, MIME-type sniffing, unsafe resource loading, and protocol downgrade attacks.
Some headers can also control which domains are allowed to load scripts, images, fonts, frames, analytics, videos, and other resources used by your funnels and websites.
Add and test one header at a time
Security headers can improve protection, but overly restrictive settings may prevent scripts, images, fonts, embeds, or widgets from loading. Add one header at a time and test the page after each change.
Security Headers at a Glance
Before You Begin
Review the page and the services it uses before applying new security restrictions.
- Confirm you can access the funnel or website settings.
- Identify the specific funnel or website you want to protect.
- List any external scripts, images, fonts, analytics tools, or embeds the page uses.
- Note any chat widgets, calendars, videos, or other third-party components.
- Decide which security header you want to add first.
- Be prepared to test the live page in multiple browsers after each change.
Configure Security Headers
Add each header individually so you can identify and reverse the most recent change if part of the page stops working.
Open Sites
From the BizStackPro dashboard, select Sites.
Select the Funnel or Website
Open Funnels or Websites, then select the asset you want to configure.
Open the Security Settings
Open Settings, then select the Security tab.
Add a New Security Header
Click Add New Security Header.
Enter the Header Name and Value
Enter the exact Header Name and Header Value you want the browser to receive.
Save and Test the Page
Save the header, preview the page, and test the live version in an incognito window and multiple browsers.
Repeat Carefully
Add the next header only after confirming the previous change did not interfere with the page. If something breaks, remove the most recent header or loosen its policy, then test again.
Starter Header Set
These commonly used headers provide starting points. Adjust each value based on the features and third-party resources your pages use.
X-Content-Type-Options
Value: nosniff
Helps prevent MIME-type sniffing.
Referrer-Policy
Value:
strict-origin-when-cross-origin
Limits how much referrer information is shared with other websites.
Permissions-Policy
Value:
camera=(), geolocation=(), microphone=()
Disables powerful browser features that may not be needed on a funnel.
X-Frame-Options
Value: DENY
Blocks the page from being embedded in an iframe, which can
reduce clickjacking risks. Pages that need to be embedded may
require a different approach, such as the CSP
frame-ancestors directive.
Strict-Transport-Security
Value:
max-age=15552000; includeSubDomains
Forces HTTPS for approximately 180 days. Add
preload only after careful testing.
Content-Security-Policy
Starter value:
default-src 'self'
This baseline policy allows resources from the same origin. External fonts, analytics, videos, images, and other resources must be explicitly allowed.
Roll out Content Security Policy gradually
Start with
Content-Security-Policy-Report-Only so you can
review violations without blocking resources. Check the browser
developer tools, identify the domains the page needs, allow only
required hosts, and enforce the policy after testing.
If the page uses chat widgets, calendars, video embeds, or other third-party tools, the policy must allow the required domains or those components may stop working.
Security Header Best Practices
Frequently Asked Questions
What are custom security headers?
Why should I use custom security headers?
How do I access the security settings to add custom headers?
What information do I need when adding a header?
Content-Security-Policy, and the header value,
such as default-src 'self'.
How do I decide which headers to use and their values?
How are headers applied?
Continue Learning
Continue learning how to configure and manage your BizStackPro funnels and websites with these related Help Center guides.
