- Make session cookies only available via HTTP (prevent access from JavaScript)
- only log PHP errors instead of displaying them in production.
Displaying errors may give attackers hints how to exploit the application
Set HTTP headers:
X-Frame-Options: DENY
Prevent Clickjacking attacks, see: http://en.wikipedia.org/wiki/Clickjacking
X-Content-Type-Options: nosniff
Prevent code injection via mime type sniffing
Former-commit-id: 4ca925874c
