I believe this could be relevant to anything that you would embed using a frame. Personally I don’t do that, I have a policy of not using 3rd party embeds after having some serious issues with them (instead I just used HTML5 media markup). But I can see people using 3rd party embeds that might open themselves to clickjacking attacks.
@manton Any further thoughts on this? Maybe just starting with something that shouldn’t break the current setup, like the HSTS settings.
@manton @sod This is my ping on this topic since it’s been over a fortnight since I last pinged about it. 
Manton is the only one who can decide if he wants to make these changes, so pinging me won’t make any difference. 
I also don’t have anything new to add beyond what I’ve already said. A reverse proxy is the way to go if you want control over this now.
Otherwise, just keep your fingers crossed that Manton wants this and eventually gets around to making the changes.
1 Like
Sorry — won’t include you on my pings again. 
I reviewed these suggestions again. I’ve decided to roll out HSTS and the nosniff change first because those seem the most low-risk. The changes will be live today, then we’ll reevaluate next steps.
Seems like things are going well… Have there been any issues reported?
Checking HTTP Observatory, it’s noted that the age setting for HSTS is low. They recommend the following:
Strict-Transport-Securityheader set to less than six months (15768000).
Basically anything six months or above.