Shopping Cart
Features and benefits of the module
- automatically adds security headers to the store – no need to tinker with the server, .htaccess, or Cloudflare configuration. After installation, the module sends the headers itself in HTTP responses.
- ready-made, secure default settings – after installation, you get default values selected to suit most stores and not break the cart functionality.
- protection against clickjacking (embedding the store in an iframe) – thanks to headers such as X-Frame-Options and/or the frame-ancestors directive in CSP, you can block “injecting” your store into a frame on third-party websites.
- control over where resources can be loaded from (CSP) – you can restrict the sources of scripts, styles, images, and connections. This is one of the strongest browser protection mechanisms (and at the same time an option that can be implemented gradually).
- enforcing HTTPS (HSTS) – if the store runs over HTTPS, the HSTS header tells the browser to always connect using an encrypted connection, making it harder to substitute an “unencrypted” version of the page.
- protection against “guessing” file types (nosniff) – the X-Content-Type-Options header reduces the risk that the browser will misinterpret a file and execute something it should not.
- fewer information leaks about where the user came from (Referrer-Policy) – you control how much page address data is passed on after clicking a link (helps limit leaks of URLs with parameters).
- blocking unnecessary browser “permissions” (Permissions-Policy) – you can disable access to features such as camera, microphone, and geolocation if the store does not use them, which reduces the “attack surface.”
- advanced cross-origin isolation headers (COOP / CORP / COEP) – they help limit risks related to opening pages and loading resources between domains. The module lets you enable them deliberately and test them safely.
- separate settings for Front Office and Back Office – you can enable headers only on the store page (for customers) or also in the admin panel, so as not to risk conflicts, for example in the BO.
- convenient management – each header has its own switch – you enable/disable specific protections with one click instead of editing files or searching for settings on the server.
- ability to edit the content of each header – if you have integrations (e.g. payments, chats, analytics), you can adjust header values to your own needs without programming.
- multistore and different domains – each store in multistore can have a different configuration (e.g. different domains, different integrations, different CSP rules), and the module respects that.
- Safe step-by-step implementation – you can enable the strictest settings (e.g. CSP/COEP) only after testing, so as not to break the cart, payments, or external scripts.
- options described in plain language – the settings include short explanations of what a given option does and when it may be useful, without requiring knowledge of web security.
- helps meet good security practices – improves the store’s “hygiene” in the eyes of browsers and audit tools (fewer warnings, better control over page behavior).
- does not require changes to store files or the template – you configure it once in the module, and the headers are sent automatically with every response.
- works with popular PrestaShop versions – the module is prepared for PrestaShop 1.6.1.x, 1.7.x, 8.x, and 9.x, so you can also use it when updating the store.