HTTP Security Headers for PrestaShop 8.x and 9.x

PS Security Headers - Free PrestaShop Module by Disciplina Digital The security of an online store doesn't end with the SSL certificate. HTTP security headers are a fundamental layer of protection that most PrestaShop installations completely ignore, and which tools like securityheaders.com evaluate and score publicly.

This post introduces PS Security Headers by Disciplina Digital, a free PrestaShop module that automatically adds all recommended security headers from the Back Office itself, without touching any server configuration files, compatible with PrestaShop 8.x and 9.x.

Why do security headers matter for your store?

When a browser loads your store, the server sends a series of HTTP headers along with the response. Most are technical and invisible to the user, but attackers and bots read them carefully. Without the right headers, your store is vulnerable to attacks such as:

XSS (Cross-Site Scripting) — injection of malicious code into your store's pages
Clickjacking — embedding your store in an iframe to deceive your customers
MIME Sniffing — the browser executes a file as a type different from the declared one
Information Disclosure — exposing the PHP version or web server facilitates targeted attacks
Downgrade attacks — forcing unencrypted HTTP connections
Cross-origin attacks — unauthorized access to resources across domains

A default PrestaShop installation (WordPress is even worse) exposes all these vulnerabilities. The securityheaders.com report reflects this with an F rating.

Headers missing in a standard PrestaShop installation
? Strict-Transport-Security
? Content-Security-Policy
? X-Frame-Options
? X-Content-Type-Options
? Referrer-Policy
? Permissions-Policy

What does PS Security Headers do?

The module hooks onto PrestaShop's actionOutputHTMLBefore to inject all recommended security headers on every HTTP response, both on the front and in the Back Office. Everything is managed from a visual configuration panel: each header has its own switch and an editable field to customize the value.

Result after installing the module
? Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
? Content-Security-Policy: default-src 'self'; ...
? X-Frame-Options: SAMEORIGIN
? X-Content-Type-Options: nosniff
? Referrer-Policy: strict-origin-when-cross-origin
? Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()
? Cross-Origin-Embedder-Policy: unsafe-none
? Cross-Origin-Opener-Policy: same-origin-allow-popups
? Cross-Origin-Resource-Policy: same-origin

It also removes the Server and X-Powered-By headers that reveal the PHP version and server software.

Headers included in the free module

Strict-Transport-Security (HSTS)

Forces the browser to always use HTTPS for your domain. The default value includes subdomains and the preload directive to submit the domain to browser preload lists.

Content-Security-Policy (CSP)

The most powerful header. It defines exactly from which origins your store can load resources: scripts, styles, images, fonts, iframes… It blocks the execution of any unauthorized resource, practically eliminating the risk of XSS. The default value is compatible with the PrestaShop core.

X-Frame-Options

Prevents your store from being embedded in an <iframe> from another domain. Direct protection against clickjacking. Default value: SAMEORIGIN.

X-Content-Type-Options

Prevents the browser from trying to guess the content type of a response. The only valid value is nosniff, which is applied.

Referrer-Policy

Controls what origin information is sent when a user navigates from your store to another site. The default value strict-origin-when-cross-origin is the recommended balance between privacy and functionality.

Permissions-Policy

Restricts browser access to sensitive APIs such as camera, microphone, geolocation or payments. An e-commerce store does not need to access any of them by default.

Cross-Origin-Embedder / Opener / Resource Policy

The three advanced CORS headers that control how your store interacts with resources and windows from other origins. Fully configurable from the panel.

Removal of Server and X-Powered-By

Two headers that add nothing to the user but reveal to attackers what software and version your server uses. The module removes them with header_remove() on every response.

Module architecture: SRP applied to PrestaShop

The module is developed following the Single Responsibility Principle (SRP). Each class has a single reason to change, which facilitates maintenance and future extension:

File structure
security_headers_dd/
??? security_headers_dd.php        ? Orchestrator: hooks and bootstrapping
??? src/
    ??? HeaderDefinition.php       ? Immutable value object per header
    ??? HeaderRegistry.php         ? Central catalog of all headers
    ??? HeaderConfiguration.php    ? Read/write in PS Configuration
    ??? HeaderEmitter.php          ? HTTP header sending
    ??? HeaderFormBuilder.php      ? Back Office form

The main module file completely delegates to these classes. If in the future you need to add a new header, you only touch HeaderRegistry.php. If you change the storage, you only touch HeaderConfiguration.php. The rest remains intact.

How to install PS Security Headers in PrestaShop

1
Download the module

Download the security_headers_dd.zip file for free from the link below.

2
Install from the Back Office

Go to Modules > Module Manager > Upload a module and upload the ZIP file. PrestaShop will install the module and apply the default values automatically.

3
Configure according to your store

Go to Modules > PS Security Headers > Configure. Review each header, enable or disable the ones you need and adjust the values according to the external services you use (Google Fonts, GTM, Stripe, etc.).

4
Check the result

Analyze your domain at securityheaders.com. You should go from an F rating to an A or A+ in a matter of seconds.

The complete installation takes less than five minutes and requires no changes to the server or PrestaShop files.

Benefits for your store

A Rating

From F to A on securityheaders.com after installation

No server touch

Everything from the Back Office, no .htaccess or nginx.conf editing

100% configurable

Each header individually activatable and editable

PS 8 & PS 9

Compatible with both major versions of PrestaShop

Clean code

SRP, PHP 8+, no external dependencies

Free

Free to use, modify and distribute

Important warning: Content-Security-Policy

The default CSP included in the module is functional with the PrestaShop core, but if your store loads external resources you must add them manually to the corresponding directive. Common resources that require adjustment:

  • Google Fonts (fonts.googleapis.com, fonts.gstatic.com)
  • Google Tag Manager / Google Analytics (*.google-analytics.com, *.googletagmanager.com)
  • Payment gateways with iframes (Stripe, PayPal, Redsys…)
  • External CDNs for scripts or styles
  • Chat widgets or marketing tools

An incorrect CSP can block legitimate resources and break store functionalities. Always check the browser console after enabling it and adjust the necessary origins before going into production.

Free download

The module is completely free. If you find it useful and want to support its development, you can buy me a coffee:

? Make a donation

You can download it without a donation as well. The code is free.