How to Add Security Headers with AWS CloudFront
Add CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy to AWS CloudFront. Copy-paste configuration included.
The 6 Essential Security Headers
Content-Security-Policy (CSP)
Controls which sources of scripts, styles, and resources are allowed. Prevents XSS by blocking inline scripts and unauthorized external scripts.
Strict-Transport-Security (HSTS)
Forces browsers to always use HTTPS, preventing protocol downgrade attacks and cookie hijacking over HTTP.
X-Frame-Options
Prevents your page from being loaded in an iframe, blocking clickjacking attacks.
X-Content-Type-Options
Prevents browsers from MIME-sniffing the content type, stopping attacks that rely on content type confusion.
Referrer-Policy
Controls how much referrer information is sent with requests, protecting user privacy and preventing information leakage.
Permissions-Policy
Controls which browser features (camera, microphone, geolocation) your page can use, reducing attack surface.
AWS CloudFront Configuration
Add this to CloudFront Console → Distributions → Select distribution → Behaviors → Edit → Response headers policy:
# AWS CLI: Create a security headers policy
aws cloudfront create-response-headers-policy --response-headers-policy-config '{
"Name": "SecurityHeadersPolicy",
"SecurityHeadersConfig": {
"XSSProtection": { "Override": true, "Protection": true, "ModeBlock": true },
"FrameOptions": { "Override": true, "FrameOption": "DENY" },
"ContentTypeOptions": { "Override": true },
"StrictTransportSecurity": { "Override": true, "AccessControlMaxAgeSec": 63072000, "IncludeSubdomains": true, "Preload": true },
"ReferrerPolicy": { "Override": true, "ReferrerPolicy": "strict-origin-when-cross-origin" },
"ContentSecurityPolicy": { "Override": true, "ContentSecurityPolicy": "default-src \u0027self\u0027;" }
}
}'CloudFront Response Headers Policies (launched 2021) let you add security headers without Lambda@Edge. Create a policy once and attach it to multiple distributions. No origin server changes needed.
How to Test Your Headers
curl -I https://your-distribution.cloudfront.netOr use Cybrove's free security check to automatically validate all security headers and get specific fix recommendations.
Frequently Asked Questions
How do I add security headers to AWS CloudFront?
Add security headers to AWS CloudFront by modifying CloudFront Console → Distributions → Select distribution → Behaviors → Edit → Response headers policy. The essential headers are CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. See the configuration example above.
How do I test if my AWS CloudFront security headers are working?
Run: curl -I https://your-distribution.cloudfront.net and check the response headers. Or use Cybrove's free security check at cybrove.com/scan which automatically validates all security headers and reports which are missing.
Which security headers are most important for AWS CloudFront?
CSP (prevents XSS), HSTS (forces HTTPS), and X-Frame-Options (prevents clickjacking) are the most critical. X-Content-Type-Options and Referrer-Policy provide additional protection with minimal configuration effort.
Check if your AWS CloudFront headers are configured correctly
Free security check validates all 6 headers plus SSL, DNS, and email authentication.
Free Security Check