Web server, reverse proxy and TYPO3 middleware
Assign headers to web servers, proxy and middleware. A TypoScript configuration for HTML does not necessarily cover other answers.
Headers and HTTPS behavior can occur before the TYPO3 application. Compare the publicly delivered response to the intended hosting configuration before attempting a sitepackage change.
Where to check the setting in TYPO3
Separate TYPO3 middleware, web server and reverse proxy as possible header sources. Mixed content also checks site base, stored external resources, and fluid output. A new header rule in the application can be overwritten by the proxy.
Example of this specific finding
Illustrative control case: An audit reports missing protective headers. Whether a frame lock is suitable depends on whether the page should be consciously embedded.
follow-up audit in TYPO3
Test HTML, downloads and static resources separately. A blanket header rule can capture different answers and block desired embeddings.
For each header, determine protection goals and affected responses. First compare a content security policy with the actually required resources and test functions.
Derogations and scope
Blindly copied headers can damage embeddings, payment or scripts. The number of headers set is not an independent proof of quality.
Reference: TYPO3 13.4 with EXT:seo. For other major versions and own extensions, responsibilities may differ; check the actually installed output.
Classify the general error
Definition, system-independent causes and further correction examples: Configure each header according to its protective task