Website Security Headers Guide

Lifetime Hosting applies security headers on lifetimehosting.in itself. Your own customer websites (domains hosted on your account) do not automatically inherit these headers — that is intentional, because a strict Content-Security-Policy can break custom themes, page builders, and third-party scripts.

We recommend every customer site on HTTPS add the four safe headers below. Add Content-Security-Policy only after you list the CDNs your site actually uses.

Where to put them (cPanel)

  1. Open cPanel → File Manager
  2. Go to your site document root (usually public_html or the domain folder)
  3. Edit .htaccess and paste the block at the top, then Save

Recommended .htaccess (safe starter)

<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

About Content-Security-Policy

CSP is powerful but site-specific. Do not copy a strict CSP from another website. If your site uses Google Analytics, chat widgets, or page builders, allow those hosts first or start in Report-Only mode with your developer.

Verify

  • Visit your site over HTTPS and hard-refresh
  • Confirm pages still load (CSS/JS/chat)
  • Re-run your security assessment / passive posture scan and generate a fresh report

Need help? Open a support ticket and include your domain name — we will review header placement without forcing a CSP that breaks your site. Open a ticket · Contact us

Support