---
schema_version: "1"
id: c81625c420dc5910bad36f34b7e0b52c83939614e8d32df86748c7602629807f
title: Enable Browser Security Settings
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/browser_security.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.browser_security.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 7122600359cbf68d9f165e076c54d5947b10aee2e174a9ef9be791c90f21e18a
description: Browser security settings protect sensitive information and monitor SSL certificates.
products:
  - Security
release: "264"
---
# Enable Browser Security Settings

Browser security settings protect sensitive information and monitor SSL certificates.

## Referrer URL Protection

When loading assets outside of Salesforce or navigating outside of Salesforce, the referrer header shows only Salesforce.com or Force.com rather than the entire URL. This feature eliminates the potential for a referrer header to reveal sensitive information that could be present in a full URL, such as an org ID. This feature is supported only for Chrome and Firefox.

## Public Key Pinning

To detect man-in-the-middle attacks, Salesforce now monitors which SSL certificates users can see. Custom certificates aren't affected. Public key pinning is supported only for Chrome and Firefox.

## HSTS (HTTP Strict Transport Security) Protection

HSTS redirects browsers to use HTTPS. It's enabled on all Salesforce and Visualforce pages and for all Experience Cloud sites and Salesforce Sites, and it can't be disabled. You can't modify the HSTS header or its values.

With HSTS enforced, the browser caches that only HTTPS can be used on the domain. The cache is saved for two years.

#### See Also

- [Session Security](https://help.salesforce.com/s/articleView?id=xcloud.security_overview_sessions.htm&release=264.0.0&type=5 "After logging in, a user establishes a session with the platform. Use session security to limit exposure to your network when a user leaves the computer unattended while still logged in. Session security also limits the risk of internal attacks, such as when one employee tries to use another employee’s session. Choose from several session settings to control session behavior.")