Security

[LRAM]

Hi
I used two websites to carry out a basic security audit on a standard BLudit 3.22 installation.
https://developer.mozilla.org/en-US/observatory
https://securityheaders.com/

No plugins installed.
In both cases, I was given a ‘D’ rating, which isn’t very reassuring.
What do I need to do to get an ‘A’?

[Surreal9951]

I have an A rating on Bludit.

You need to add rules to the .htaccess file.

So it's not a “bug” in Bludit, but rather a matter of server rule settings.

[LRAM]

I’m using the .htaccess file that comes with Bludit.
Have you made any changes to it?

[arfa]

@Surreal9951

>> You need to add rules to the .htaccess file.
I wonder if you would mind sharing what you have done? Both the htaccess mods and which locations.

thx

[LRAM]

Below is what I added using Gemini to get the rating up to an A.
I’ve still got one warning.
Content-Security-Policy This policy contains 'unsafe-inline' which is dangerous in the script-src directive. This policy contains 'unsafe-eval' which is dangerous in the script-src directive.

Code: Select all

AddDefaultCharset UTF-8

# ==========================================
# 1. Redirection HTTPS & HSTS
# ==========================================
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /

    # Force HTTPS (Nécessaire pour le score)
    RewriteCond %{HTTPS} off
    RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
</IfModule>

# ==========================================
# 2. En-têtes de Sécurité HTTP
# ==========================================
<IfModule mod_headers.c>
    # Empêche le chargement dans une iframe (protection Clickjacking)
    Header always set X-Frame-Options "SAMEORIGIN"

    # Bloque le sniffing de type MIME
    Header always set X-Content-Type-Options "nosniff"

    # Contrôle la transmission du Referrer
    Header always set Referrer-Policy "strict-origin-when-cross-origin"

    # Désactive les fonctionnalités inutilisées du navigateur
    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"

    # HSTS : Force HTTPS pendant 1 ans (requis par SSL Labs/Observatory)
    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

    # Content Security Policy (CSP) basique adaptée à Bludit
    Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:;"
</IfModule>

# ==========================================
# 3. Masquer la signature serveur
# ==========================================
ServerSignature Off

# ==========================================
# 4. Règles de routage Bludit (Original)
# ==========================================
<IfModule mod_rewrite.c>
    # Interdire l'accès direct aux dossiers sensibles
    RewriteRule ^bl-content/(databases|workspaces|pages|tmp)/.*$ - [R=404,L]

    # Routage vers index.php
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteRule ^(.*) index.php [PT,L]
</IfModule>