# HTTP Security Header Not Detected - Vulnerability **URL:** \ **Category:** Elasticsearch\ **Created:** [July 9, 2019, 9:45am UTC](https://discuss.elastic.co/t/http-security-header-not-detected-vulnerability/189506 "2019-07-09T09:45:04Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Zerobot](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zerobot/32/48977_2.png) [@Zerobot](https://discuss.elastic.co/u/Zerobot)\ **Post date:** [July 9, 2019, 9:45am UTC](https://discuss.elastic.co/t/http-security-header-not-detected-vulnerability/189506/1 "2019-07-09T09:45:04Z")
Hello! Scans in my company detected a vulnerability from the title - is there any way to set HTTP Headers on Elasticsearch? We are using Elastic 6.8.0. ---
**Author:** ![xeraa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xeraa/32/48181_2.png) [@xeraa](https://discuss.elastic.co/u/xeraa)\ **Post date:** [July 9, 2019, 1:57pm UTC](https://discuss.elastic.co/t/http-security-header-not-detected-vulnerability/189506/2 "2019-07-09T13:57:10Z")
I assume you got this from an automated check like [https://securityheaders.com](https://securityheaders.com)? That is for websites anybody would browse (and applies to Kibana for example), but it doesn't make much sense for a datastore; eg you wouldn't run this against MySQL (if it had an HTTP interface), right? ---
**Author:** ![Zerobot](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zerobot/32/48977_2.png) [@Zerobot](https://discuss.elastic.co/u/Zerobot)\ **Post date:** [July 9, 2019, 2:36pm UTC](https://discuss.elastic.co/t/http-security-header-not-detected-vulnerability/189506/3 "2019-07-09T14:36:41Z")
Sadly, no. This vulnerability is a result from QUALYS scanning. I understand that this result may be a 'false positive' but I would be very gratefull if someone here would confirm it 🙂 As you pointed - Security Headers for Kibana would make a lot of sense, for Elasticsearch I don't really know, I guess not? ---
**Author:** ![xeraa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xeraa/32/48181_2.png) [@xeraa](https://discuss.elastic.co/u/xeraa)\ **Post date:** [July 9, 2019, 3:38pm UTC](https://discuss.elastic.co/t/http-security-header-not-detected-vulnerability/189506/4 "2019-07-09T15:38:24Z")
> [@Zerobot](#): > > Sadly, no. This vulnerability is a result from QUALYS scanning. Different scanner but pretty much the same thing 🙂 Are your users going to browse the Elasticsearch endpoints? I'm pretty sure the answer is no, so those headers don't make sense 🤷‍♂️ ---
**Author:** ![joshbressers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/joshbressers/32/42332_2.png) [@joshbressers](https://discuss.elastic.co/u/joshbressers)\ **Post date:** [July 9, 2019, 4:10pm UTC](https://discuss.elastic.co/t/http-security-header-not-detected-vulnerability/189506/5 "2019-07-09T16:10:00Z")
@Zerobot You're welcome to mail [security@elastic.co](mailto:security@elastic.co) with the specific results if you want an official answer. ---
**Author:** ![Zerobot](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zerobot/32/48977_2.png) [@Zerobot](https://discuss.elastic.co/u/Zerobot)\ **Post date:** [July 9, 2019, 4:25pm UTC](https://discuss.elastic.co/t/http-security-header-not-detected-vulnerability/189506/6 "2019-07-09T16:25:35Z")
Thank you very much, I'll do exactly that ! 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 6, 2019, 4:25pm UTC](https://discuss.elastic.co/t/http-security-header-not-detected-vulnerability/189506/7 "2019-08-06T16:25:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.