[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-05 (世界標準時間)。"],[[["\u003cp\u003eCloud CDN and Cloud Load Balancing can enhance web security when serving content from various sources, including Compute Engine, Cloud Storage, or external origins.\u003c/p\u003e\n"],["\u003cp\u003eSecurity headers, like \u003ccode\u003eStrict-Transport-Security\u003c/code\u003e, \u003ccode\u003eX-Frame-Options\u003c/code\u003e, and \u003ccode\u003eContent-Security-Policy\u003c/code\u003e, control client behavior, content embedding, cross-domain content, and TLS usage, and can be implemented using custom response headers.\u003c/p\u003e\n"],["\u003cp\u003eSetting the \u003ccode\u003eStrict-Transport-Security\u003c/code\u003e (HSTS) header forces clients to connect over HTTPS, which is irreversible, and care must be taken with the \u003ccode\u003eincludeSubdomains\u003c/code\u003e or \u003ccode\u003epreload\u003c/code\u003e directives.\u003c/p\u003e\n"],["\u003cp\u003eManaged TLS certificates are provided at no cost, are easily deployable to load balancers, automatically renew, and are globally distributed, offering data authenticity and confidentiality.\u003c/p\u003e\n"],["\u003cp\u003eUtilizing modern TLS protocols, such as TLS 1.3, and setting minimum TLS versions through SSL policies, enhances security and allows for improved performance with protocols like HTTP/2 and QUIC.\u003c/p\u003e\n"]]],[],null,["# Web security best practices\n\nBest practices for web security\n-------------------------------\n\nCloud CDN and Cloud Load Balancing can help you meet web\nsecurity best practices, whether you're serving content from\nCompute Engine instances, a Cloud Storage bucket, or an\nexternal origin located outside of Google Cloud.\n\n### Set security headers\n\nThe HTTP specification has a number of headers that control the following:\n\n- Client behavior\n- How content is embedded\n- How content is served across domains\n- Whether to always use TLS (HTTPS) when connecting to that domain\n\nThese controls are typically represented as HTTP response headers, which you can\nset for each backend (*origin* , in CDN terms) as [custom response\nheaders](/load-balancing/docs/custom-headers) for your\nexternal Application Load Balancer and Cloud CDN deployment.\n\nIf you are using Cloud Storage and serving web content from your\nbucket, you can use Cloud CDN [in front of your storage\nbucket](/cdn/docs/setting-up-cdn-with-bucket) to set web security headers and\ncache popular content.\n\nThe most useful web security headers are defined in the following table.\n\nUse caution when introducing new security headers to existing websites,\nbecause they can break third-party scripts, embedded content (for example, in\niframes), or other aspects of your sites. Before making changes to your\nproduction traffic, we recommend creating a second instance of your backend\nbucket or backend service and testing.\n\nYou can read more about web security headers and best practices on\n[web.dev](https://web.dev/secure/) as well on Mozilla's\n[infosec site](https://infosec.mozilla.org/guidelines/web_security).\n\n### TLS and certificate management\n\n[Managed certificates](/load-balancing/docs/ssl-certificates/google-managed-certs)\nhave the following characteristics:\n\n- Are provided at no cost\n- Can be easily deployed to your load balancers\n- Automatically renew\n- Are globally distributed to all of Google's edge locations\n\nTLS provides authenticity by validating that data has not been modified in\ntransit. TLS certificates provide confidentiality by making sure that an\neavesdropper cannot determine what is being exchanged between users and servers.\nThis is important for user privacy and security.\n\nWith SSL certificates, you can benefit from modern transport protocols, such as\n[HTTP/2](https://developers.google.com/web/fundamentals/performance/http2) and\nGoogle's [QUIC protocol](https://cloud.google.com/blog/products/gcp/introducing-quic-support-https-load-balancing), both of which require SSL (TLS). These\nprotocols directly improve the performance of web content, media delivery\n(such as streaming video), and reliability over congested networks.\n\nGoogle Cloud supports modern TLS protocols (such as TLS 1.3) across\nCloud Load Balancing and Cloud CDN services.\n\nYou can use [SSL policies](/load-balancing/docs/use-ssl-policies) to raise the\nminimum version of TLS. We recommend raising the version to TLS v1.2, if you\ndon't need to support older clients, such as embedded devices\nor older (more than 10 years old) non-browser clients. Globally, TLS v1.0 and\nTLS v1.1 represent less than 0.5% of connections across Google Cloud.\nIf you need to identify or associate specific clients with outdated versions of\nTLS, you can use the `{tls_version}` [variable in a request\nheader](/load-balancing/docs/user-defined-request-headers#variables). You can\nthen log this information.\n\nWhat's next\n-----------\n\n- To check whether Cloud CDN is serving responses from cache, see [Viewing logs](/cdn/docs/logging).\n- To learn about which content is cacheable or non-cacheable, see [Caching overview](/cdn/docs/caching).\n- To see Cloud CDN's points of presence, see [Cache locations](/cdn/docs/locations)."]]
