Recent machine room let rectification of the loopholes set cookie HttpOnly x-frame-options header is not set

Https://www.jb51.net/article/105018.htm

Settings in PHP

PHP5.2 above has supported the setting of the HttpOnly parameter, also supports the setting of global HttpOnly, in php.ini
-----------------------------------------------------
Session.cookie_httponly = 1
-----------------------------------------------------

Setting its value to 1 or true to turn on the HttpOnly property of the global cookie, and of course, supports the opening of the Code:

?

123	<?php ini_set("session.cookie_httponly", 1);  // or session_set_cookie_params(0, NULL, NULL, NULL, TRUE); ?>

The cookie manipulation function Setcookie function and the Setrawcookie function are also specifically added with the 7th parameter as an option for HttpOnly, with the opening method:

?

1234	<?phpsetcookie("abc", "test", NULL, NULL, NULL, NULL, TRUE); setrawcookie("abc", "test", NULL, NULL, NULL, NULL, TRUE);?>

For previous versions of PHP5.1 and PHP4 versions, you need to use the header function to work around the following:

?

123	<?php header ( "Set-cookie: Hidden=value; HttpOnly " ); ?>

                         ,         &NB Sp                          ,         &NB Sp                          ,         &NB Sp                          ,         &NB Sp                          ,         &NB Sp                          ,         &NB Sp                          ,         &NB Sp                                                            ,         &N Bsp                          ,         &NB Sp                          ,         &NB Sp                            HTTP://WWW.SDL cseo.com/629.html 

Everyone in the use of virtual machine to build WordPress blog, I believe will use 360 Web site security detection to check the security of the site, using WordPress blog program build blog How much will be reported some loopholes, today WiFi department arrested X-frame-options head not set The hint, though a slight loophole, looked uncomfortable, so the problem was dealt with.
X-frame-options Header Not set fix method:
One, Apache configuration
Configure Apache to send the x-frame-options response header on all pages, you need to add this line of code to the configuration: Apache configuration httpd.conf first Open mod_header.so extension

1. Header always append x-frame-options sameorigin

Second, nginx configuration
Configure the Nginx Send X-frame-options response header and add the following line of code to the configuration of ' http ', ' server ' or ' location ':

1.add_header x-frame-options Sameorigin

Third, IIS configuration (virtual machine private)
Configure IIS to send the x-frame-options response header, and add the following code to the Web. config file (for example):

2. <customHeaders>
3. <add name="x-frame-options" value="Sameorigin"/>
4. </customHeaders>

Recent machine room let rectification of the loopholes set cookie HttpOnly x-frame-options header is not set