How to Fix Missing Security Headers in Laravel

The Problem

How to Fix

1. 1

   Create a security headers middleware

   Generate a new middleware:

   php artisan make:middleware SecurityHeaders

   Then add the headers in app/Http/Middleware/SecurityHeaders.php:

   <?php

   namespace App\Http\Middleware;

   use Closure;
   use Illuminate\Http\Request;

   class SecurityHeaders
   {
       public function handle(Request $request, Closure $next)
       {
           $response = $next($request);

   $response->headers->set('X-Frame-Options', 'SAMEORIGIN');
           $response->headers->set('X-Content-Type-Options', 'nosniff');
           $response->headers->set('X-XSS-Protection', '1; mode=block');
           $response->headers->set('Referrer-Policy', 'strict-origin-when-cross-origin');
           $response->headers->set('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
           $response->headers->set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
           $response->headers->set('Content-Security-Policy', "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; connect-src 'self'; frame-ancestors 'self'");

   return $response; } }

2. 2

   Register the middleware globally

   In Laravel 11+, add to bootstrap/app.php:

   ->withMiddleware(function (Middleware $middleware) {
       $middleware->append(\App\Http\Middleware\SecurityHeaders::class);
   })

   In Laravel 10 and earlier, add to the $middleware array in app/Http/Kernel.php:

   protected $middleware = [
       // ... existing middleware
       \App\Http\Middleware\SecurityHeaders::class,
   ];

3. 3

   Customize Content-Security-Policy for your app

   The CSP header needs to match your application. If you use external scripts (analytics, Stripe, etc.), add their domains:

   Content-Security-Policy: default-src 'self'; script-src 'self' https://js.stripe.com https://www.googletagmanager.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' https://fonts.gstatic.com; connect-src 'self' https://api.stripe.com; frame-src https://js.stripe.com;

   Start with Content-Security-Policy-Report-Only to test without breaking your site, then switch to enforcing mode once verified.

How to Verify

curl -I https://yourdomain.com

You should see all security headers in the response. You can also use securityheaders.com to scan your site and get a grade. Aim for an A or A+ rating.

Prevention

Frequently Asked Questions