Add HTTP headers security mention to security.html - refs #2013

documentation/security.html

@@ -23,6 +23,7 @@
   <li><a href="#3.Using-safe-browsers">Using safe browsers</a></li>
   <li><a href="#4.Moving-config-file">Moving your configuration file out of the web directory</a></li>
   <li><a href="#5.Files-permissions">Restricting files permissions</a></li>
+  <li><a href="#6.HSPS">HTTP Headers Security</a></li>
 </ol>
 
 <h2><a name="1.Disclosing-server-info"></a>1. Disclosing server info</h2>
@@ -87,6 +88,21 @@ This will prevent direct access to your settings and make it seem totally the sa
 
 
     <hr />
+<h2>HTTP Headers Security</h2>
+    <p>A relatively recent development in web security, HTTP headers can be modified either
+    from the web server or from the application (like Chamilo) to increase the security
+        of your visitors.</p>
+    <p>These implies several aspects, from simple to complex, to deal with, from stuff like
+    indicating which websites you say media or libraries can be loaded from, to adding
+    extra info about your SSL certificate to make sure a hacked certification authority
+        will not immediately make your certificate useless.</p>
+    <p>In Chamilo 1.11.6, we have added several parameters, together with recommendations,
+    to main/install/configuration.dist.php, that you are free to use or ignore,
+        depending on the level of security you want to achieve.</p>>
+    <p>To check your portal for possible improvements in terms of headers security,
+        we highly recommend the <a href="https://securityheaders.io/">securityheaders.io</a>
+        website. If you want to read more about CSP and all related headers
+        security techniques, check <a href="https://scotthelme.co.uk/">Scott Helme's blog</a>.
 <h2>Authors</h2>
 <ul>
 <li>Yannick Warnier, Zend Certified PHP Engineer, BeezNest Belgium SPRL,