Can I add security headers (CSP, HSTS, X-Frame-Options) without touching the backend?

Short answer

Yes. In the Manage HTTP Security Headers action, Content-Security-Policy, Strict-Transport-Security (HSTS), X-Frame-Options, X-XSS-Protection, X-Content-Type-Options, Referrer-Policy and Permissions-Policy are selected from the Response Headers list; the headers are added with their preset values to all responses returning from the Backend Service. If a preset value does not suit the application (e.g. a CSP that uses an external CDN), the header is written with a custom value with Set HTTP Header at the On Response stage. HSTS can also be provided through the TLS Security Profile.

Problem: Security Headers Are Missing, and the Application Cannot Be Touched

Security scans and audits report that headers such as CSP, HSTS and X-Frame-Options are missing; changing the application is not always possible or quick. The headers are added while the response passes through TR7, without touching the Backend Service.

Solution: Four Methods

The methods work on the HTTP vService and can be used together: the headers whose preset value is suitable are added with Method 1, and those that need a custom value with Method 2.

Your situation	Suitable method
Quick setup with preset values	Method 1: Manage HTTP Security Headers
Application-specific value; a single header should remain even if the Backend Service sends the same header	Method 2: Set HTTP Header (On response)
The Backend Service never sends the same header	Method 3: Add HTTP Header (On response)
Only HSTS; with duration and subdomain settings	Method 4: TLS Security Profile → HSTS

Method 1: Manage HTTP Security Headers Recommended

• How it works The selected headers are added with their preset values to all responses; the values cannot be edited, and the action takes no condition.
• Where it is openedLoad Balancer → Actions → Manage HTTP Security Headers → Response Headers
• Requirement At least one selection; the compatibility of the preset CSP with the application is tested beforehand
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the action form

Load Balancer → Actions → Add is clicked (how to add).

2

Adım 2 Enter the action name and type

Action Name is entered, and Action Type = Manage HTTP Security Headers is selected.

3

Adım 3 Check the headers

The headers are checked in the Response Headers list. The option labels also show the values:

Option	Written value	If the Backend Service sends the same header
Content-Security-Policy	default-src 'self';	Replaces it
Strict-Transport-Security (HSTS)	max-age=16000000; includeSubDomains; preload; (only in HTTPS responses)	Replaces it
X-Frame-Options	SAMEORIGIN	Replaces it
X-XSS-Protection	1; mode=block	A second copy is added
X-Content-Type-Options	nosniff	A second copy is added
Referrer-Policy	no-referrer-when-downgrade	Replaces it
Permissions-Policy	interest-cohort=(); (written with the name Permission-Policy)	The Permissions-Policy header of the Backend Service does not change; a separate header is added next to it

If a Permissions-Policy that restricts permissions such as location and camera is required, the header is written with Method 2.

4

Adım 4 Save the action

Add is clicked.

5

Adım 5 Edit the vService

On the Load Balancer → Load Balancer vService List screen, the HTTP vService is selected and Edit is clicked.

6

Adım 6 Add the action to the Actions field

The action is selected in the Details → Actions field.

7

Adım 7 Save

Save is clicked. The change is applied without dropping open connections; in a cluster, it is also sent to the peer device with the default auto-sync (if Manual Sync Mode is on, with Synchronize).

Verification

1ResponseClient side

curl -skI https://www.example.com/

ExpectedThe selected headers appear with the values written in the table

2BrowserClient side

The Console tab in the developer tools of the browser is checked; the resources blocked by CSP are listed here.

ExpectedNo CSP violation; the page loads without breaking

Method 2: Set HTTP Header (On Response)

• How it works The header is written with the desired value; a single header remains even if the Backend Service sends the same header.
• Where it is openedLoad Balancer → Actions → Set HTTP Header
• Requirement A separate action for each header
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the action form

Load Balancer → Actions → Add is clicked.

2

Adım 2 Select the action type

Action Type = Set HTTP Header is selected.

3

Adım 3 Write the header

Execution Level = On response (cannot be changed after saving); Header to Edit = Content-Security-Policy; Header Content = default-src 'self'; script-src 'self' https://cdn.example.com.

4

Adım 4 Save the action

Add is clicked; steps 1–4 are repeated for each header (e.g. Permissions-Policy = camera=(), microphone=(), geolocation=()).

5

Adım 5 Edit the vService

The vService is opened with Edit.

6

Adım 6 Add the actions to the Actions field

The actions are selected in the Details → Actions field.

7

Adım 7 Save

Save is clicked. If the same header is also selected in Method 1, the value of the action that comes later in the list remains.

Verification

1ResponseClient side

curl -skI https://www.example.com/ | grep -i '^content-security-policy'

ExpectedA single line, the custom value

Method 3: Add HTTP Header (On Response)

• How it works The header is added to the response; if the Backend Service sends the same header, a second copy is created.
• Where it is openedLoad Balancer → Actions → Add HTTP Header
• Requirement The Backend Service does not send the same header
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the action form

Load Balancer → Actions → Add is clicked.

2

Adım 2 Select the action type

Action Type = Add HTTP Header is selected.

3

Adım 3 Write the header

Execution Level = On response; Header to Add = Cross-Origin-Opener-Policy, Header Content = same-origin (banking application scenario).

4

Adım 4 Save the action

Add is clicked.

5

Adım 5 Edit the vService

The vService is opened with Edit.

6

Adım 6 Add the action to the Actions field

The action is selected in the Details → Actions field.

7

Adım 7 Save

Save is clicked.

Verification

1ResponseClient side

curl -skI https://www.example.com/ | grep -i '^cross-origin-opener-policy'

ExpectedThe header appears once

Method 4: TLS Security Profile → HSTS

• How it works The HSTS header is added from the TLS security profile assigned to the vService; the duration, subdomains and preload are selected separately. If the HSTS option of Manage HTTP Security Headers is also on in the same vService, the value of the action takes effect.
• Where it is openedCertificates & PKI → TLS Security Profiles → Frontend-only Settings → HSTS
• Requirement An encrypted (HTTPS) frontend row on the vService and the SSL Security module
• vService type HTTP

Step-by-Step Configuration

1

Adım 1 Open the profile form

Certificates & PKI → TLS Security Profiles → Add is clicked (Edit for an existing profile) (how to add).

2

Adım 2 Turn on HSTS

In the Frontend-only Settings section, HSTS (Strict-Transport-Security header) (off by default) is turned on; HSTS Duration (max-age) (default 180 days) and Include Subdomains (includeSubDomains) (off by default) are set. Details: How do I add HSTS?

3

Adım 3 Save the profile

Add is clicked for a new profile, or Edit if an existing profile was edited.

4

Adım 4 Edit the vService

The vService is opened with Edit.

5

Adım 5 Assign the profile to the vService

The profile is selected in the Details → SSL Security module.

6

Adım 6 Save

Save is clicked.

Verification

1ResponseClient side

curl -skI https://www.example.com/ | grep -i '^strict-transport-security'

ExpectedStrict-Transport-Security: max-age=…

Common Mistakes

• Turning on the preset CSP value without testing it. default-src 'self' can block external CDNs, fonts and inline scripts; it is first tested in a test environment, or a suitable value is written with Set HTTP Header.
• Thinking that HSTS will also be sent in HTTP responses. HSTS is added only to HTTPS responses; the browser also takes into account only the HSTS header it receives over HTTPS.
• Creating a duplicate header with Add. If the Backend Service already sends the header, Add HTTP Header (and the X-XSS-Protection and X-Content-Type-Options options in Manage HTTP Security Headers) adds a second copy; Set HTTP Header is used.
• Expecting headers on the pages produced by TR7 itself. The headers are added to the responses returning from the Backend Service; they are not added to the blocking, redirect and error pages produced by TR7.
• Confusing it with the SSL Labs score. For handling the headers and the TLS settings together: What should I do to get an A+ from SSL Labs?

How it is done in the documentation

• Manage HTTP Security Headers · The Security Headers That Can Be Selected
• Manage HTTP Security Headers · Overwriting the Existing Headers
• Set HTTP Header · Header Content
• TLS Security Profiles · HSTS (Strict-Transport-Security header)

Related questions

• How do I add HSTS?
• How do I hide headers that reveal server information, such as Server and X-Powered-By?
• Can I automatically add the Secure, HttpOnly and SameSite attributes to cookies?