{"id":33159,"date":"2025-10-30T11:01:52","date_gmt":"2025-10-30T08:01:52","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/cloudflare-ile-guvenlik-basliklari-ekleme-kapsamli-rehber\/"},"modified":"2025-10-30T11:01:52","modified_gmt":"2025-10-30T08:01:52","slug":"cloudflare-ile-guvenlik-basliklari-ekleme-kapsamli-rehber","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/cloudflare-ile-guvenlik-basliklari-ekleme-kapsamli-rehber\/","title":{"rendered":"Cloudflare ile G\u00fcvenlik Ba\u015fl\u0131klar\u0131 Ekleme: Kapsaml\u0131 Rehber"},"content":{"rendered":"

<\/p>\n

Web sitenizin \u00e7evrimi\u00e7i g\u00fcvenli\u011fini art\u0131rmak i\u00e7in Cloudflare \u00fczerinden HTTP g\u00fcvenlik ba\u015fl\u0131klar\u0131 nas\u0131l eklenir? Bu kapsaml\u0131 rehber, taray\u0131c\u0131 tabanl\u0131 sald\u0131r\u0131lara kar\u015f\u0131 g\u00fc\u00e7l\u00fc bir koruma kalkan\u0131 olu\u015fturan bu kritik ba\u015fl\u0131klar\u0131 ad\u0131m ad\u0131m yap\u0131land\u0131rmay\u0131 ve web sitenizi daha g\u00fcvenli hale getirmeyi detayl\u0131ca a\u00e7\u0131kl\u0131yor. Dijital varl\u0131\u011f\u0131n\u0131z\u0131 koruma alt\u0131na al\u0131n.<\/p>\n

G\u00fcn\u00fcm\u00fcz\u00fcn dijital d\u00fcnyas\u0131nda, bir web sitesi sahibi olmak sadece i\u00e7erik yay\u0131nlamak veya \u00fcr\u00fcn satmak anlam\u0131na gelmiyor; ayn\u0131 zamanda kullan\u0131c\u0131 verilerini korumak ve siber sald\u0131r\u0131lara kar\u015f\u0131 sa\u011flam bir savunma hatt\u0131 olu\u015fturmak demektir. Ne yaz\u0131k ki, k\u00f6t\u00fc niyetli akt\u00f6rler s\u00fcrekli olarak yeni sald\u0131r\u0131 vekt\u00f6rleri geli\u015ftirmekte ve web uygulamalar\u0131n\u0131 hedef almaktad\u0131r. Bu sald\u0131r\u0131lar\u0131n \u00f6nemli bir k\u0131sm\u0131, do\u011frudan taray\u0131c\u0131lar arac\u0131l\u0131\u011f\u0131yla ger\u00e7ekle\u015fir ve kullan\u0131c\u0131lar\u0131n hassas bilgilerini ele ge\u00e7irmeyi, oturumlar\u0131n\u0131 ka\u00e7\u0131rmay\u0131 veya sitenin b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc bozmay\u0131 ama\u00e7lar. \u0130\u015fte tam bu noktada, HTTP g\u00fcvenlik ba\u015fl\u0131klar\u0131 devreye girerek pasif bir savunma mekanizmas\u0131 olmaktan \u00e7\u0131k\u0131p aktif bir koruma kalkan\u0131 haline gelir.<\/p>\n

Peki, bu g\u00fcvenlik ba\u015fl\u0131klar\u0131 tam olarak ne i\u015fe yarar? Temel olarak, HTTP g\u00fcvenlik ba\u015fl\u0131klar\u0131, sunucunuzdan taray\u0131c\u0131ya g\u00f6nderilen yan\u0131tlara eklenen \u00f6zel direktiflerdir. Bu direktifler, taray\u0131c\u0131ya i\u00e7eri\u011fi nas\u0131l i\u015flemesi, hangi kaynaklara g\u00fcvenmesi ve belirli g\u00fcvenlik politikalar\u0131n\u0131 nas\u0131l uygulamas\u0131 gerekti\u011fi konusunda net talimatlar verir. \u00d6rne\u011fin, “X-Frame-Options” ba\u015fl\u0131\u011f\u0131, web sitenizin ba\u015fka bir site i\u00e7inde iframe olarak g\u00f6sterilmesini engelleyerek clickjacking sald\u0131r\u0131lar\u0131n\u0131n \u00f6n\u00fcne ge\u00e7er. “Content-Security-Policy” (CSP) ise, sitenizin hangi kaynaklardan (scriptler, stiller, resimler vb.) i\u00e7erik y\u00fckleyebilece\u011fini belirleyerek \u00e7apraz site komut dosyas\u0131 (XSS) sald\u0131r\u0131lar\u0131na kar\u015f\u0131 en g\u00fc\u00e7l\u00fc savunmalardan birini sunar. Bu ba\u015fl\u0131klar olmadan, taray\u0131c\u0131lar genellikle varsay\u0131lan, daha az g\u00fcvenli davran\u0131\u015flar\u0131 sergiler ve bu durum, sald\u0131rganlar\u0131n g\u00fcvenlik a\u00e7\u0131klar\u0131ndan faydalanmas\u0131na zemin haz\u0131rlar.<\/p>\n

Bu ba\u015fl\u0131klar\u0131n uygulanmas\u0131, sadece sitenizin g\u00fcvenli\u011fini art\u0131rmakla kalmaz, ayn\u0131 zamanda kullan\u0131c\u0131lar\u0131n\u0131za da g\u00fcven verir. Modern taray\u0131c\u0131lar, bu g\u00fcvenlik ba\u015fl\u0131klar\u0131n\u0131 anlar ve uygular; bu da sitenizin potansiyel risklere kar\u015f\u0131 daha diren\u00e7li olmas\u0131n\u0131 sa\u011flar. Ayr\u0131ca, HTTPS kullan\u0131m\u0131yla birlikte bu ba\u015fl\u0131klar, sitenizin genel g\u00fcvenlik profilini \u00f6nemli \u00f6l\u00e7\u00fcde y\u00fckseltir ve arama motoru s\u0131ralamalar\u0131nda dahi dolayl\u0131 yoldan olumlu etki yaratabilir, zira g\u00fcvenli siteler genellikle daha iyi s\u0131ralan\u0131r. Bir di\u011fer \u00f6nemli avantaj\u0131 ise, g\u00fcvenlik ba\u015fl\u0131klar\u0131n\u0131n bir\u00e7o\u011funun sunucu kaynaklar\u0131n\u0131 a\u015f\u0131r\u0131 derecede t\u00fcketmeden h\u0131zl\u0131 bir \u015fekilde uygulanabilmesidir. \u00d6zellikle Cloudflare gibi bir CDN (\u0130\u00e7erik Da\u011f\u0131t\u0131m A\u011f\u0131) kullan\u0131yorsan\u0131z, bu ba\u015fl\u0131klar\u0131 sunucu taraf\u0131nda karma\u015f\u0131k konfig\u00fcrasyonlar yapman\u0131za gerek kalmadan, sadece birka\u00e7 t\u0131klama ile global olarak da\u011f\u0131tabilirsiniz. Bu, hem zaman tasarrufu sa\u011flar hem de g\u00fcvenlik politikalar\u0131n\u0131z\u0131n h\u0131zl\u0131 ve tutarl\u0131 bir \u015fekilde uygulanmas\u0131n\u0131 garantiler. Bu ba\u011flamda, her web sitesi sahibinin bu kritik ara\u00e7lar\u0131 anlamas\u0131 ve do\u011fru bir \u015fekilde uygulamas\u0131, dijital varl\u0131\u011f\u0131n\u0131 korumak i\u00e7in ataca\u011f\u0131 en temel ad\u0131mlardan biridir.<\/p>\n

HTTP G\u00fcvenlik Ba\u015fl\u0131klar\u0131 Nelerdir ve Neden Gereklidir?<\/h2>\n
Web g\u00fcvenli\u011fi d\u00fcnyas\u0131nda, HTTP g\u00fcvenlik ba\u015fl\u0131klar\u0131, bir web sitesinin savunma stratejisinin temel ta\u015flar\u0131ndan biridir. Bu ba\u015fl\u0131klar, sunucu taraf\u0131ndan web taray\u0131c\u0131s\u0131na g\u00f6nderilen HTTP yan\u0131tlar\u0131n\u0131n bir par\u00e7as\u0131 olarak iletilen \u00f6zel talimatlard\u0131r. Taray\u0131c\u0131lar, bu talimatlar\u0131 alarak sitenin i\u00e7eri\u011fini nas\u0131l i\u015flemesi ve potansiyel g\u00fcvenlik tehditlerine kar\u015f\u0131 nas\u0131l tepki vermesi gerekti\u011fi konusunda bilgilendirilir. Gelin, en yayg\u0131n ve etkili HTTP g\u00fcvenlik ba\u015fl\u0131klar\u0131ndan baz\u0131lar\u0131n\u0131 ve her birinin neden bu kadar \u00f6nemli oldu\u011funu detayl\u0131ca inceleyelim.<\/p>\n
\u0130lk olarak, Content-Security-Policy (CSP)<\/strong>, belki de en g\u00fc\u00e7l\u00fc ve karma\u015f\u0131k g\u00fcvenlik ba\u015fl\u0131\u011f\u0131d\u0131r. CSP, web sitenizin hangi kaynaklardan (betikler, stil sayfalar\u0131, resimler, fontlar vb.) i\u00e7erik y\u00fckleyebilece\u011fini belirlemenize olanak tan\u0131r. Bu sayede, k\u00f6t\u00fc niyetli enjekte edilmi\u015f betiklerin (XSS sald\u0131r\u0131lar\u0131) \u00e7al\u0131\u015fmas\u0131n\u0131 veya yetkisiz kaynaklardan veri y\u00fcklenmesini engelleyebilirsiniz. \u00d6rne\u011fin, yaln\u0131zca kendi alan ad\u0131n\u0131zdan ve belirli bir CDN’den betiklerin y\u00fcklenmesine izin vererek, d\u0131\u015far\u0131dan gelebilecek bir\u00e7ok tehdidi bertaraf edebilirsiniz. CSP, sitenizin savunmas\u0131n\u0131 \u00f6nemli \u00f6l\u00e7\u00fcde g\u00fc\u00e7lendirirken, yanl\u0131\u015f yap\u0131land\u0131r\u0131lmas\u0131 durumunda sitenizin i\u015flevselli\u011fini de bozabilir, bu y\u00fczden dikkatli bir \u015fekilde olu\u015fturulmas\u0131 gerekir.<\/p>\n
Bir di\u011fer vazge\u00e7ilmez ba\u015fl\u0131k ise Strict-Transport-Security (HSTS)<\/strong>, di\u011fer ad\u0131yla Strict-Transport-Security<\/code> ba\u015fl\u0131\u011f\u0131d\u0131r. Bu ba\u015fl\u0131k, taray\u0131c\u0131lara belirli bir s\u00fcre boyunca (max-age<\/code> direktifi ile belirtilir) sitenizle yaln\u0131zca HTTPS \u00fczerinden ileti\u015fim kurmalar\u0131n\u0131 emreder. Yani, kullan\u0131c\u0131 sitenize HTTP \u00fczerinden eri\u015fmeye \u00e7al\u0131\u015fsa bile, taray\u0131c\u0131 otomatik olarak iste\u011fi HTTPS’ye y\u00f6nlendirir. Bu, man-in-the-middle (ortadaki adam) sald\u0131r\u0131lar\u0131na ve SSL stripping gibi tehditlere kar\u015f\u0131 kritik bir koruma sa\u011flar, ayr\u0131ca kullan\u0131c\u0131lar\u0131n sitenize her zaman \u015fifreli bir ba\u011flant\u0131 \u00fczerinden eri\u015fmesini garantiler. HSTS, sitenizin g\u00fcvenli\u011fine olan ba\u011fl\u0131l\u0131\u011f\u0131n\u0131z\u0131 g\u00f6steren g\u00fc\u00e7l\u00fc bir sinyaldir.<\/p>\n
X-Frame-Options<\/strong> ba\u015fl\u0131\u011f\u0131, web sitenizin ba\u015fka bir site i\u00e7inde <\/code>, <\/code> veya <code><object><\/code> olarak g\u00f6r\u00fcnt\u00fclenip g\u00f6r\u00fcnt\u00fclenemeyece\u011fini kontrol eder. Bu, \u00f6zellikle clickjacking sald\u0131r\u0131lar\u0131na kar\u015f\u0131 koruma sa\u011flar. Clickjacking’de, sald\u0131rganlar \u015feffaf bir \u00e7er\u00e7eve kullanarak kullan\u0131c\u0131lar\u0131 fark\u0131nda olmadan k\u00f6t\u00fc niyetli bir i\u015flemi t\u0131klamaya y\u00f6nlendirirler. Bu ba\u015fl\u0131\u011f\u0131 <code>DENY<\/code> veya <code>SAMEORIGIN<\/code> olarak ayarlayarak, sitenizin bu t\u00fcr sald\u0131r\u0131lara maruz kalmas\u0131n\u0131 engelleyebilirsiniz.<\/p>\n<p><strong>X-Content-Type-Options<\/strong> ba\u015fl\u0131\u011f\u0131 ise taray\u0131c\u0131lar\u0131n MIME sniffing (MIME t\u00fcr\u00fc koklama) \u00f6zelli\u011fini devre d\u0131\u015f\u0131 b\u0131rakmas\u0131n\u0131 sa\u011flar. MIME sniffing, taray\u0131c\u0131lar\u0131n bir dosyan\u0131n i\u00e7eri\u011fini analiz ederek ger\u00e7ek MIME t\u00fcr\u00fcn\u00fc tahmin etme yetene\u011fidir. Sald\u0131rganlar, bu \u00f6zelli\u011fi kullanarak bir betik dosyas\u0131n\u0131 bir resim gibi g\u00f6stermeye \u00e7al\u0131\u015fabilirler. Bu ba\u015fl\u0131\u011f\u0131 <code>nosniff<\/code> de\u011feriyle kullanarak, taray\u0131c\u0131n\u0131n belirtilen <code>Content-Type<\/code> ba\u015fl\u0131\u011f\u0131na uymas\u0131n\u0131 zorlars\u0131n\u0131z ve b\u00f6ylece potansiyel g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 kapat\u0131rs\u0131n\u0131z.<\/p>\n<p><strong>Referrer-Policy<\/strong> ba\u015fl\u0131\u011f\u0131, bir web sitesinden ba\u015fka bir siteye yap\u0131lan isteklerde “Referer” ba\u015fl\u0131\u011f\u0131n\u0131n ne kadar bilgi i\u00e7erece\u011fini kontrol eder. Bu ba\u015fl\u0131k, hassas bilgilerin (\u00f6rne\u011fin URL’deki oturum kimlikleri) \u00fc\u00e7\u00fcnc\u00fc taraflara s\u0131zmas\u0131n\u0131 engelleyerek gizlili\u011fi art\u0131r\u0131r. <code>no-referrer<\/code>, <code>same-origin<\/code>, <code>strict-origin-when-cross-origin<\/code> gibi \u00e7e\u015fitli de\u011ferlerle, ihtiya\u00e7lar\u0131n\u0131za g\u00f6re bilgi payla\u015f\u0131m d\u00fczeyini ayarlayabilirsiniz.<\/p>\n<p>Son olarak, <strong>Permissions-Policy<\/strong> (eski ad\u0131yla Feature-Policy) daha modern bir g\u00fcvenlik ba\u015fl\u0131\u011f\u0131d\u0131r. Bu ba\u015fl\u0131k, bir web sayfas\u0131n\u0131n veya g\u00f6m\u00fcl\u00fc iframe’lerin taray\u0131c\u0131n\u0131n belirli \u00f6zelliklerini (\u00f6rne\u011fin kamera, mikrofon, konum sens\u00f6rleri, tam ekran modu) kullan\u0131p kullanamayaca\u011f\u0131n\u0131 kontrol etmenizi sa\u011flar. Bu, sitenizin potansiyel olarak k\u00f6t\u00fcye kullan\u0131labilecek taray\u0131c\u0131 \u00f6zelliklerini k\u0131s\u0131tlayarak kullan\u0131c\u0131 gizlili\u011fini ve g\u00fcvenli\u011fini daha da art\u0131r\u0131r.<\/p>\n<p>T\u00fcm bu ba\u015fl\u0131klar, modern bir web sitesinin savunma stratejisinin ayr\u0131lmaz par\u00e7alar\u0131d\u0131r. Her biri farkl\u0131 bir sald\u0131r\u0131 vekt\u00f6r\u00fcn\u00fc hedef alarak sitenizin genel g\u00fcvenlik duru\u015funu g\u00fc\u00e7lendirir. Bu ba\u015fl\u0131klar\u0131 do\u011fru bir \u015fekilde uygulamak, sitenizi sadece mevcut tehditlere kar\u015f\u0131 korumakla kalmaz, ayn\u0131 zamanda gelecekte ortaya \u00e7\u0131kabilecek yeni tehditlere kar\u015f\u0131 da daha diren\u00e7li hale getirir.<\/p>\n<h2>Cloudflare’da G\u00fcvenlik Ba\u015fl\u0131klar\u0131 Nas\u0131l Yap\u0131land\u0131r\u0131l\u0131r? \u2013 Ad\u0131m Ad\u0131m Rehber<\/h2>\n<p>Cloudflare, web sitenizin performans\u0131n\u0131 art\u0131rman\u0131n ve DDoS sald\u0131r\u0131lar\u0131na kar\u015f\u0131 koruma sa\u011flaman\u0131n \u00f6tesinde, g\u00fcvenlik ba\u015fl\u0131klar\u0131n\u0131 kolayca y\u00f6netmenize olanak tan\u0131yan g\u00fc\u00e7l\u00fc ara\u00e7lar sunar. Geleneksel olarak, bu ba\u015fl\u0131klar\u0131 sunucu yap\u0131land\u0131rma dosyalar\u0131nda (Apache i\u00e7in <code>.htaccess<\/code> veya Nginx i\u00e7in <code>nginx.conf<\/code> gibi) eklemek gerekirdi ki bu, teknik bilgi gerektiren ve hata yapmaya a\u00e7\u0131k bir s\u00fcre\u00e7ti. Ancak Cloudflare’\u0131n “Transform Rules” \u00f6zelli\u011fi sayesinde, sunucuya dokunmadan, sezgisel bir aray\u00fcz \u00fczerinden bu ba\u015fl\u0131klar\u0131 kolayca ekleyebilir ve y\u00f6netebilirsiniz. \u015eimdi, bu s\u00fcreci ad\u0131m ad\u0131m inceleyelim.<\/p>\n<h3>Ad\u0131m 1: Cloudflare Paneline Giri\u015f Yap\u0131n ve Do\u011fru Alan Ad\u0131n\u0131 Se\u00e7in<\/h3>\n<p>\u0130lk olarak, Cloudflare hesab\u0131n\u0131za giri\u015f yapman\u0131z ve g\u00fcvenlik ba\u015fl\u0131klar\u0131n\u0131 eklemek istedi\u011finiz alan ad\u0131n\u0131 se\u00e7meniz gerekmektedir. Panelin sol taraf\u0131ndaki men\u00fcden “Rules” (Kurallar) se\u00e7ene\u011fini bulun ve t\u0131klay\u0131n. Bu, size “Page Rules”, “Transform Rules”, “Origin Rules” gibi se\u00e7enekleri g\u00f6sterecektir. G\u00fcvenlik ba\u015fl\u0131klar\u0131n\u0131 eklemek i\u00e7in “Transform Rules” sekmesine t\u0131klaman\u0131z gerekiyor.<\/p>\n<h3>Ad\u0131m 2: “Modify Response Header” Kural\u0131 Olu\u015fturma<\/h3>\n<p>“Transform Rules” sayfas\u0131nda, “Modify Response Header” (Yan\u0131t Ba\u015fl\u0131\u011f\u0131n\u0131 De\u011fi\u015ftir) sekmesine gidin. Burada, “Create Transform Rule” (Transform Kural\u0131 Olu\u015ftur) butonunu g\u00f6receksiniz. Bu butona t\u0131klayarak yeni bir kural olu\u015fturma i\u015flemine ba\u015flayabilirsiniz. A\u00e7\u0131lan pencerede, kural\u0131n\u0131za a\u00e7\u0131klay\u0131c\u0131 bir isim verin, \u00f6rne\u011fin “G\u00fcvenlik Ba\u015fl\u0131klar\u0131 Ekleme” veya “X-Frame-Options”.<\/p>\n<h3>Ad\u0131m 3: Kural\u0131n Uygulanaca\u011f\u0131 Alan\u0131 Belirleyin<\/h3>\n<p>Herhangi bir kuralda oldu\u011fu gibi, bu g\u00fcvenlik ba\u015fl\u0131\u011f\u0131 kural\u0131n\u0131n hangi isteklere uygulanaca\u011f\u0131n\u0131 tan\u0131mlaman\u0131z gerekir. Genellikle, t\u00fcm gelen isteklere uygulanmas\u0131n\u0131 istersiniz. Bunun i\u00e7in “When incoming requests match” (Gelen istekler e\u015fle\u015fti\u011finde) b\u00f6l\u00fcm\u00fcnde, “Field” olarak “Hostname”, “Operator” olarak “equals”, ve “Value” olarak sitenizin tam alan ad\u0131n\u0131 (\u00f6rn. <code>www.example.com<\/code>) girebilirsiniz. E\u011fer t\u00fcm alt alan adlar\u0131 dahil her \u015feye uygulanmas\u0131n\u0131 istiyorsan\u0131z, “Field” olarak “Hostname”, “Operator” olarak “contains”, ve “Value” olarak sadece ana alan ad\u0131n\u0131z\u0131 (\u00f6rn. <code>example.com<\/code>) kullanabilirsiniz. Genellikle varsay\u0131lan olarak “All incoming requests” se\u00e7ene\u011fi de yeterli olabilir, ancak daha spesifik olman\u0131z her zaman tavsiye edilir.<\/p>\n<h3>Ad\u0131m 4: G\u00fcvenlik Ba\u015fl\u0131\u011f\u0131n\u0131 Ekleme<\/h3>\n<p>\u015eimdi en \u00f6nemli k\u0131sma geldik: g\u00fcvenlik ba\u015fl\u0131\u011f\u0131n\u0131 eklemek. “Then” (Daha sonra) b\u00f6l\u00fcm\u00fcnde, “Modify response header” (Yan\u0131t ba\u015fl\u0131\u011f\u0131n\u0131 de\u011fi\u015ftir) se\u00e7ene\u011fini se\u00e7in. Eylem olarak “Set static” (Statik ayarla) se\u00e7ene\u011fini kullanaca\u011f\u0131z, \u00e7\u00fcnk\u00fc g\u00fcvenlik ba\u015fl\u0131klar\u0131m\u0131z genellikle sabit de\u011ferlere sahiptir. \u00d6rne\u011fin, X-Frame-Options ba\u015fl\u0131\u011f\u0131n\u0131 eklemek i\u00e7in:<\/p>\n<ul>\n<li><strong>Header Name (Ba\u015fl\u0131k Ad\u0131):<\/strong> <code>X-Frame-Options<\/code><\/li>\n<li><strong>Value (De\u011fer):<\/strong> <code>DENY<\/code> (veya <code>SAMEORIGIN<\/code>)<\/li>\n<\/ul>\n<p>Bu \u015fekilde, taray\u0131c\u0131lara sitenizin hi\u00e7bir \u015fekilde ba\u015fka bir \u00e7er\u00e7eve i\u00e7inde g\u00f6r\u00fcnt\u00fclenemeyece\u011fini belirtmi\u015f olursunuz. Bir ba\u015fka \u00f6rnek olarak, X-Content-Type-Options ba\u015fl\u0131\u011f\u0131n\u0131 ekleyelim:<\/p>\n<ul>\n<li><strong>Header Name (Ba\u015fl\u0131k Ad\u0131):<\/strong> <code>X-Content-Type-Options<\/code><\/li>\n<li><strong>Value (De\u011fer):<\/strong> <code>nosniff<\/code><\/li>\n<\/ul>\n<p>Bu, taray\u0131c\u0131lar\u0131n MIME sniffing yapmas\u0131n\u0131 engelleyerek olas\u0131 g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 kapat\u0131r. Birden fazla g\u00fcvenlik ba\u015fl\u0131\u011f\u0131 eklemek i\u00e7in “Add new header” (Yeni ba\u015fl\u0131k ekle) butonuna t\u0131klayarak ayn\u0131 ad\u0131mlar\u0131 tekrarlayabilirsiniz.<\/p>\n<h3>Ad\u0131m 5: Kural\u0131 Kaydet ve Da\u011f\u0131t<\/h3>\n<p>T\u00fcm istedi\u011finiz ba\u015fl\u0131klar\u0131 ekledikten sonra, “Deploy” (Da\u011f\u0131t) veya “Save” (Kaydet) butonuna t\u0131klayarak kural\u0131n\u0131z\u0131 kaydedin. Cloudflare, bu kural\u0131 k\u0131sa s\u00fcrede global a\u011f\u0131nda da\u011f\u0131tacak ve sitenize gelen t\u00fcm uygun isteklere bu ba\u015fl\u0131klar\u0131 eklemeye ba\u015flayacakt\u0131r. Da\u011f\u0131t\u0131m genellikle an\u0131nda ger\u00e7ekle\u015fir, ancak baz\u0131 durumlarda birka\u00e7 dakika s\u00fcrebilir.<\/p>\n<pre><code class=\"language-http\">\nHTTP\/1.1 200 OK\nContent-Type: text\/html; charset=utf-8\nX-Frame-Options: DENY\nX-Content-Type-Options: nosniff\nReferrer-Policy: no-referrer-when-downgrade\nContent-Security-Policy: default-src 'self'; script-src 'self' https:\/\/trusted.cdn.com; img-src 'self' data:; style-src 'self' 'unsafe-inline';\n...\n<\/pre>\n<p><\/code><\/p>\n<p>Yukar\u0131daki \u00f6rnek HTTP yan\u0131t\u0131, Cloudflare \u00fczerinden ba\u015far\u0131yla eklenmi\u015f g\u00fcvenlik ba\u015fl\u0131klar\u0131n\u0131 g\u00f6stermektedir. G\u00f6rd\u00fc\u011f\u00fcn\u00fcz gibi, her bir ba\u015fl\u0131k ayr\u0131 bir sat\u0131rda yer almakta ve taray\u0131c\u0131ya ek g\u00fcvenlik talimatlar\u0131 iletmektedir.<\/p>\n<div class=\"expert-tip\">\n Uzman \u0130pucu: Kural\u0131n\u0131z\u0131 kaydetmeden \u00f6nce, ba\u015fl\u0131k adlar\u0131n\u0131 ve de\u011ferlerini do\u011fru yazd\u0131\u011f\u0131n\u0131zdan emin olun. Yanl\u0131\u015f yaz\u0131lan bir ba\u015fl\u0131k, beklenmedik davran\u0131\u015flara veya g\u00fcvenlik a\u00e7\u0131klar\u0131na yol a\u00e7abilir. Ayr\u0131ca, ilk kez uygulad\u0131\u011f\u0131n\u0131zda sitenizin t\u00fcm i\u015flevlerini test etmeyi unutmay\u0131n.\n<\/div>\n<p>Bu y\u00f6ntemle Cloudflare \u00fczerinden g\u00fcvenlik ba\u015fl\u0131klar\u0131 eklemek, sunucu yap\u0131land\u0131rma karma\u015fas\u0131ndan kurtulman\u0131z\u0131 sa\u011flar ve g\u00fcvenlik duru\u015funuzu \u00f6nemli \u00f6l\u00e7\u00fcde g\u00fc\u00e7lendirir. \u00d6zellikle CSP gibi karma\u015f\u0131k ba\u015fl\u0131klar i\u00e7in bu kolayl\u0131k paha bi\u00e7ilemezdir, \u00e7\u00fcnk\u00fc s\u00fcrekli g\u00fcncellemeler ve ince ayarlar gerektirebilirler. Bu ad\u0131mlar\u0131 takip ederek web sitenizi daha g\u00fcvenli bir hale getirebilirsiniz.<\/p>\n<h2>Content Security Policy (CSP) Olu\u015fturma ve Cloudflare ile Da\u011f\u0131tma<\/h2>\n<p>Content Security Policy (CSP), web g\u00fcvenli\u011finin en g\u00fc\u00e7l\u00fc ve en \u00e7ok y\u00f6nl\u00fc ba\u015fl\u0131klar\u0131ndan biridir. Temelde, CSP bir web sayfas\u0131n\u0131n hangi kaynaklar\u0131 (betikler, stil sayfalar\u0131, resimler, medya, fontlar vb.) y\u00fckleyebilece\u011fini tan\u0131mlayan bir beyan mekanizmas\u0131d\u0131r. Bu, \u00f6zellikle Cross-Site Scripting (XSS) sald\u0131r\u0131lar\u0131 gibi yayg\u0131n ve y\u0131k\u0131c\u0131 web g\u00fcvenlik a\u00e7\u0131klar\u0131na kar\u015f\u0131 son derece etkili bir savunma sa\u011flar. Bir sald\u0131rgan web sitenize k\u00f6t\u00fc niyetli bir betik enjekte etse bile, do\u011fru yap\u0131land\u0131r\u0131lm\u0131\u015f bir CSP, bu beti\u011fin \u00e7al\u0131\u015fmas\u0131n\u0131 engelleyebilir. Ancak CSP'nin g\u00fcc\u00fc, ayn\u0131 zamanda karma\u015f\u0131kl\u0131\u011f\u0131ndan da kaynaklan\u0131r; do\u011fru bir CSP olu\u015fturmak ve s\u00fcrd\u00fcrmek \u00f6zen gerektirir.<\/p>\n<h3>CSP Neden Bu Kadar \u00d6nemli?<\/h3>\n<p>XSS sald\u0131r\u0131lar\u0131, web \u00fczerinde en s\u0131k g\u00f6r\u00fclen ve en tehlikeli sald\u0131r\u0131 t\u00fcrlerinden biridir. Bu sald\u0131r\u0131lar, sald\u0131rganlar\u0131n web sitenize k\u00f6t\u00fc niyetli istemci taraf\u0131 betikleri enjekte etmelerine olanak tan\u0131r. Enjekte edilen betik, kullan\u0131c\u0131lar\u0131n taray\u0131c\u0131s\u0131nda \u00e7al\u0131\u015f\u0131r ve \u00e7erezleri \u00e7alabilir, oturum belirte\u00e7lerini ele ge\u00e7irebilir, sayfa i\u00e7eri\u011fini de\u011fi\u015ftirebilir veya kullan\u0131c\u0131lar\u0131 k\u00f6t\u00fc ama\u00e7l\u0131 sitelere y\u00f6nlendirebilir. CSP, taray\u0131c\u0131n\u0131n yaln\u0131zca \"g\u00fcvenli\" olarak tan\u0131mlad\u0131\u011f\u0131n\u0131z kaynaklardan gelen i\u00e7eri\u011fi y\u00fcklemesine izin vererek bu t\u00fcr sald\u0131r\u0131lar\u0131 etkili bir \u015fekilde engeller. Bu, sitenizin veri b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc ve kullan\u0131c\u0131lar\u0131n\u0131z\u0131n gizlili\u011fini korumak i\u00e7in hayati \u00f6neme sahiptir.<\/p>\n<h3>CSP Olu\u015fturma S\u00fcreci: Bir Denge Sanat\u0131<\/h3>\n<p>CSP olu\u015fturmak, sitenizin t\u00fcm kaynaklar\u0131n\u0131 dikkatlice incelemeyi gerektiren bir denge sanat\u0131d\u0131r. Ba\u015flang\u0131\u00e7ta \u00e7ok k\u0131s\u0131tlay\u0131c\u0131 bir CSP olu\u015fturursan\u0131z, sitenizin baz\u0131 b\u00f6l\u00fcmleri d\u00fczg\u00fcn \u00e7al\u0131\u015fmayabilir. \u00c7ok gev\u015fek olursa, g\u00fcvenlik faydalar\u0131n\u0131 kaybedersiniz. CSP genellikle <code>default-src<\/code> y\u00f6nergesiyle ba\u015flar ve ard\u0131ndan <code>script-src<\/code>, <code>style-src<\/code>, <code>img-src<\/code> gibi daha spesifik y\u00f6nergelerle \u00f6zelle\u015ftirilir. Her y\u00f6nerge, belirli bir kaynak t\u00fcr\u00fc i\u00e7in izin verilen URL'leri veya anahtar kelimeleri (\u00f6rne\u011fin, <code>'self'<\/code> kendi alan ad\u0131n\u0131z\u0131, <code>'unsafe-inline'<\/code> sat\u0131r i\u00e7i betiklere\/stillere izin verir) listeler.<\/p>\n<p>CSP olu\u015fturmaya yard\u0131mc\u0131 olan bir\u00e7ok \u00e7evrimi\u00e7i ara\u00e7 bulunmaktad\u0131r. \u00d6rne\u011fin, <a href=\"https:\/\/csp-evaluator.withgoogle.com\/\" target=\"_blank\" rel=\"noopener noreferrer\">Google CSP Evaluator<\/a> veya <a href=\"https:\/\/csp.withgoogle.com\/\" target=\"_blank\" rel=\"noopener noreferrer\">CSP Generator<\/a> gibi ara\u00e7lar, mevcut sitenizin HTTP ba\u015fl\u0131klar\u0131n\u0131 analiz ederek veya sizin verdi\u011finiz parametrelere g\u00f6re bir taslak CSP olu\u015fturman\u0131za yard\u0131mc\u0131 olabilir. Genellikle, CSP'yi <code>report-only<\/code> modunda ba\u015flatmak ve sitenizi g\u00f6zlemlemek en g\u00fcvenli yakla\u015f\u0131md\u0131r. Bu modda, ihlaller taray\u0131c\u0131 konsoluna ve belirtilen bir <code>report-uri<\/code> (veya <code>report-to<\/code>) adresine raporlan\u0131r, ancak sitenin \u00e7al\u0131\u015fmas\u0131 engellenmez.<\/p>\n<h3>Cloudflare ile CSP Da\u011f\u0131tma<\/h3>\n<p>Cloudflare'\u0131n Transform Rules \u00f6zelli\u011fi, CSP'yi web sitenize eklemenin en pratik yollar\u0131ndan biridir. Daha \u00f6nce de belirtildi\u011fi gibi, \"Modify Response Header\" kural\u0131n\u0131 kullanarak CSP'yi ekleyebilirsiniz. \u0130\u015fte temel bir CSP \u00f6rne\u011fi ve Cloudflare'da nas\u0131l eklenece\u011fi:<\/p>\n<pre><code class=\"language-csp\">\nContent-Security-Policy: default-src 'self'; script-src 'self' https:\/\/www.google-analytics.com https:\/\/cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; form-action 'self'; frame-ancestors 'none'; report-uri https:\/\/your-reporting-endpoint.com\/csp-report;\n<\/pre>\n<p><\/code><\/p>\n<p>Bu CSP \u00f6rne\u011fi:<\/p>\n<ul>\n<li><code>default-src 'self'<\/code>: Varsay\u0131lan olarak t\u00fcm kaynaklar\u0131n sadece kendi alan ad\u0131n\u0131zdan y\u00fcklenmesine izin verir.<\/li>\n<li><code>script-src 'self' https:\/\/www.google-analytics.com https:\/\/cdnjs.cloudflare.com<\/code>: Betiklerin sadece kendi alan\u0131n\u0131zdan, Google Analytics'ten ve Cloudflare CDN'den y\u00fcklenmesine izin verir.<\/li>\n<li><code>style-src 'self' 'unsafe-inline'<\/code>: Stil sayfalar\u0131n\u0131n kendi alan\u0131n\u0131zdan ve sat\u0131r i\u00e7i stiller (baz\u0131 frameworkler i\u00e7in gerekli olabilir) arac\u0131l\u0131\u011f\u0131yla y\u00fcklenmesine izin verir. <code>'unsafe-inline'<\/code> kullanmaktan ka\u00e7\u0131nmak ideal olsa da, baz\u0131 durumlarda ge\u00e7ici bir \u00e7\u00f6z\u00fcm olabilir.<\/li>\n<li><code>img-src 'self' data:<\/code>: Resimlerin kendi alan\u0131n\u0131zdan ve base64 kodlu (data:) URL'lerden y\u00fcklenmesine izin verir.<\/li>\n<li><code>frame-ancestors 'none'<\/code>: Sitenizin hi\u00e7bir yerde \u00e7er\u00e7eve olarak kullan\u0131lmas\u0131na izin vermez (X-Frame-Options ile benzer i\u015flev).<\/li>\n<li><code>report-uri https:\/\/your-reporting-endpoint.com\/csp-report<\/code>: CSP ihlallerinin g\u00f6nderilece\u011fi bir raporlama hizmeti belirtir. Bu, CSP'nizi geli\u015ftirirken veya izlerken kritik \u00f6neme sahiptir.<\/li>\n<\/ul>\n<p>Cloudflare Transform Rules'da bu ba\u015fl\u0131\u011f\u0131 eklerken, \"Header Name\" olarak <code>Content-Security-Policy<\/code> ve \"Value\" olarak yukar\u0131daki t\u00fcm direktifleri tek bir sat\u0131rda girmeniz yeterlidir. E\u011fer <code>report-only<\/code> modunu kullanmak isterseniz, ba\u015fl\u0131k ad\u0131n\u0131 <code>Content-Security-Policy-Report-Only<\/code> olarak de\u011fi\u015ftirmeniz gerekir.<\/p>\n<h3>Vaka Analizi: E-Ticaret Sitesi ve CSP Entegrasyonu<\/h3>\n<p>K\u00fc\u00e7\u00fck bir e-ticaret sitesi olan \"H\u0131zl\u0131Moda\", XSS sald\u0131r\u0131lar\u0131na kar\u015f\u0131 korunmas\u0131zd\u0131. Geli\u015ftiriciler, Cloudflare \u00fczerinden bir CSP entegrasyonuna karar verdi. Ba\u015flang\u0131\u00e7ta, t\u00fcm scriptlerin \u00e7al\u0131\u015ft\u0131\u011f\u0131 \u00fc\u00e7\u00fcnc\u00fc taraf eklentileri nedeniyle olduk\u00e7a karma\u015f\u0131k bir CSP ile kar\u015f\u0131la\u015ft\u0131lar. \u0130lk denemede, \u00e7ok k\u0131s\u0131tlay\u0131c\u0131 bir CSP uygulad\u0131lar ve bu, sitenin \u00f6deme a\u011f ge\u00e7idinin ve canl\u0131 destek widget'\u0131n\u0131n \u00e7al\u0131\u015fmamas\u0131na neden oldu. H\u0131zl\u0131ca <code>Content-Security-Policy-Report-Only<\/code> moduna ge\u00e7erek sitenin canl\u0131 kalmas\u0131n\u0131 sa\u011flad\u0131lar. Bir hafta boyunca toplanan ihlal raporlar\u0131n\u0131 (bir CSP raporlama hizmeti kullanarak) analiz ettiler ve hangi kaynaklar\u0131n engellendi\u011fini ve nedenini belirlediler. Yava\u015f yava\u015f, \u00f6deme a\u011f ge\u00e7idi ve canl\u0131 destek i\u00e7in gerekli olan belirli CDN'leri ve script kaynaklar\u0131n\u0131 <code>script-src<\/code> ve <code>connect-src<\/code> y\u00f6nergelerine ekleyerek CSP'yi g\u00fc\u00e7lendirdiler. Bu s\u00fcre\u00e7 sonunda, site tamamen i\u015flevsel kal\u0131rken, olas\u0131 XSS sald\u0131r\u0131lar\u0131na kar\u015f\u0131 \u00e7ok daha diren\u00e7li hale geldi. Bu vaka, CSP entegrasyonunun iteratif (tekrarlamal\u0131) bir s\u00fcre\u00e7 oldu\u011funu ve dikkatli izleme gerektirdi\u011fini g\u00f6stermektedir.<\/p>\n<div class=\"expert-tip\">\n Uzman \u0130pucu: CSP'nizi olu\u015ftururken veya g\u00fcncellerken, her zaman <code>Content-Security-Policy-Report-Only<\/code> ba\u015fl\u0131\u011f\u0131n\u0131 kullanarak test edin. Bu, sitenizin i\u015flevselli\u011fini etkilemeden potansiyel ihlalleri g\u00f6rmenizi sa\u011flar. Raporlar\u0131 analiz ettikten sonra, g\u00fcvenle <code>Content-Security-Policy<\/code> ba\u015fl\u0131\u011f\u0131na ge\u00e7ebilirsiniz.\n<\/div>\n<p>CSP'nin do\u011fru bir \u015fekilde uygulanmas\u0131, web sitenizin g\u00fcvenli\u011fini dramatik bir \u015fekilde art\u0131r\u0131r. Cloudflare ile bu s\u00fcreci y\u00f6netmek, karma\u015f\u0131kl\u0131\u011f\u0131 azalt\u0131rken, g\u00fc\u00e7l\u00fc bir savunma mekanizmas\u0131 olu\u015fturman\u0131za olanak tan\u0131r.<\/p>\n<h2>\u0130leri D\u00fczey G\u00fcvenlik Ba\u015fl\u0131\u011f\u0131 Uygulamalar\u0131 ve Optimizasyon \u0130pu\u00e7lar\u0131<\/h2>\n<p>Temel HTTP g\u00fcvenlik ba\u015fl\u0131klar\u0131n\u0131 Cloudflare \u00fczerinden ba\u015far\u0131yla uygulad\u0131ktan sonra, web sitenizin savunmas\u0131n\u0131 daha da g\u00fc\u00e7lendirmek i\u00e7in ileri d\u00fczey tekniklere ve optimizasyon ipu\u00e7lar\u0131na ge\u00e7ebiliriz. Bu b\u00f6l\u00fcmde, daha az bilinen ancak olduk\u00e7a etkili ba\u015fl\u0131klar\u0131 ve g\u00fcvenlik duru\u015funuzu s\u00fcrekli iyile\u015ftirmek i\u00e7in kullanabilece\u011finiz stratejileri ele alaca\u011f\u0131z.<\/p>\n<h3>HSTS Preloading (\u00d6n Y\u00fckleme) ile Maksimum HTTPS Korumas\u0131<\/h3>\n<p>Daha \u00f6nce bahsetti\u011fimiz HSTS (HTTP Strict Transport Security) ba\u015fl\u0131\u011f\u0131, taray\u0131c\u0131lar\u0131 sitenizle sadece HTTPS \u00fczerinden ileti\u015fim kurmaya zorlar. Ancak HSTS'nin ilk ziyarette bir zay\u0131fl\u0131\u011f\u0131 vard\u0131r: Kullan\u0131c\u0131 sitenizi ilk kez ziyaret etti\u011finde, taray\u0131c\u0131 hen\u00fcz HSTS ba\u015fl\u0131\u011f\u0131n\u0131 almam\u0131\u015f olabilir ve bu k\u0131sa s\u00fcre zarf\u0131nda bir HTTP ba\u011flant\u0131s\u0131 kurulabilir. Bu \"ilk ziyaret\" zay\u0131fl\u0131\u011f\u0131n\u0131 gidermek i\u00e7in, HSTS Preloading (\u00d6n Y\u00fckleme) kullan\u0131labilir. Bu, sitenizi HSTS Preload listesine ekleterek, b\u00fcy\u00fck taray\u0131c\u0131lar\u0131n (Chrome, Firefox, Edge vb.) sitenizin her zaman HTTPS \u00fczerinden y\u00fcklenmesi gerekti\u011fini varsaymas\u0131n\u0131 sa\u011flar, daha ilk ba\u011flant\u0131dan itibaren. Listeye girmek i\u00e7in belirli kriterleri (HTTPS'yi her yerde zorunlu k\u0131lmak, belirli bir <code>max-age<\/code> de\u011feri ayarlamak ve <code>includeSubDomains<\/code> ile <code>preload<\/code> direktiflerini eklemek gibi) kar\u015f\u0131laman\u0131z gerekir. Sitenizi <a href=\"https:\/\/hstspreload.org\/\" target=\"_blank\" rel=\"noopener noreferrer\">hstspreload.org<\/a> adresinden ba\u015fvurarak bu listeye ekletebilirsiniz. Cloudflare, HSTS ayarlar\u0131n\u0131 kolayca yapman\u0131za olanak tan\u0131r ve hatta preload direktifini eklemenize yard\u0131mc\u0131 olabilir.<\/p>\n<h3>Permissions-Policy ile Taray\u0131c\u0131 \u00d6zelliklerini K\u0131s\u0131tlama<\/h3>\n<p>Modern taray\u0131c\u0131lar, konum, kamera, mikrofon, jiroskop gibi bir\u00e7ok g\u00fc\u00e7l\u00fc API ve \u00f6zelli\u011fe eri\u015fim sa\u011flar. <code>Permissions-Policy<\/code> ba\u015fl\u0131\u011f\u0131 (eski ad\u0131yla <code>Feature-Policy<\/code>), bu t\u00fcr taray\u0131c\u0131 \u00f6zelliklerinin sitenizde (veya sitenizdeki iframe'lerde) kullan\u0131l\u0131p kullan\u0131lamayaca\u011f\u0131n\u0131 detayl\u0131 bir \u015fekilde kontrol etmenizi sa\u011flar. \u00d6rne\u011fin, bir blog sitesinin kamera veya mikrofon eri\u015fimine ihtiyac\u0131 yoktur. Bu ba\u015fl\u0131k ile bu \u00f6zellikleri devre d\u0131\u015f\u0131 b\u0131rakarak potansiyel k\u00f6t\u00fcye kullan\u0131mlar\u0131 engelleyebilirsiniz. \u00d6rne\u011fin:<\/p>\n<pre><code class=\"language-http\">\nPermissions-Policy: geolocation=(), camera=(), microphone=(), fullscreen=(self)\n<\/pre>\n<p><\/code><\/p>\n<p>Bu ba\u015fl\u0131k, konum, kamera ve mikrofon eri\u015fimini tamamen devre d\u0131\u015f\u0131 b\u0131rak\u0131rken, tam ekran modunun sadece kendi alan ad\u0131n\u0131zdan kullan\u0131lmas\u0131na izin verir. Bu, kullan\u0131c\u0131 gizlili\u011fini ve sitenizin g\u00fcvenlik duru\u015funu art\u0131rmak i\u00e7in harika bir yoldur ve Cloudflare Transform Rules arac\u0131l\u0131\u011f\u0131yla kolayca eklenebilir.<\/p>\n<h3>Raporlama Mekanizmalar\u0131 ile S\u00fcrekli G\u00f6zlem<\/h3>\n<p>G\u00fcvenlik ba\u015fl\u0131klar\u0131n\u0131 uygulamak sadece bir ba\u015flang\u0131\u00e7t\u0131r; bunlar\u0131 s\u00fcrekli olarak izlemek ve ihlalleri raporlamak da e\u015fit derecede \u00f6nemlidir. CSP'nin <code>report-uri<\/code> veya <code>report-to<\/code> direktifleri, ihlal raporlar\u0131n\u0131 belirli bir u\u00e7 noktaya g\u00f6ndermenizi sa\u011flar. Benzer \u015fekilde, <code>Expect-CT<\/code> ba\u015fl\u0131\u011f\u0131, siteniz i\u00e7in kullan\u0131lan Sertifika \u015eeffafl\u0131\u011f\u0131 (Certificate Transparency) politikalar\u0131n\u0131 kontrol eder ve yanl\u0131\u015fl\u0131kla veya k\u00f6t\u00fc niyetli olarak verilmi\u015f sertifikalar\u0131 tespit etmek i\u00e7in raporlama yapabilir. Bu raporlar\u0131 toplamak ve analiz etmek i\u00e7in \u00f6zel hizmetler (\u00f6rn. Report URI, Sentry) veya kendi raporlama u\u00e7 noktalar\u0131n\u0131z\u0131 kurabilirsiniz. Bu, g\u00fcvenlik ba\u015fl\u0131klar\u0131n\u0131zda ince ayar yapman\u0131za ve yeni tehditlere kar\u015f\u0131 daha h\u0131zl\u0131 tepki vermenize yard\u0131mc\u0131 olur.<\/p>\n<h3>G\u00fcvenlik Ba\u015fl\u0131klar\u0131n\u0131 Test Etme ve \u0130zleme Ara\u00e7lar\u0131<\/h3>\n<p>Uygulad\u0131\u011f\u0131n\u0131z g\u00fcvenlik ba\u015fl\u0131klar\u0131n\u0131n do\u011fru \u00e7al\u0131\u015ft\u0131\u011f\u0131ndan ve istenen etkiyi yaratt\u0131\u011f\u0131ndan emin olmak i\u00e7in \u00e7e\u015fitli ara\u00e7lar kullanman\u0131z \u00f6nemlidir:<\/p>\n<ul>\n<li><a href=\"https:\/\/securityheaders.com\/\" target=\"_blank\" rel=\"noopener noreferrer\">SecurityHeaders.com<\/a>: Sitenizin g\u00fcvenlik ba\u015fl\u0131klar\u0131n\u0131 analiz eder ve size bir puanlama ile birlikte eksik veya yanl\u0131\u015f yap\u0131land\u0131r\u0131lm\u0131\u015f ba\u015fl\u0131klar\u0131 g\u00f6sterir.<\/li>\n<li><strong>OWASP ZAP (Zed Attack Proxy)<\/strong>: Bir g\u00fcvenlik test arac\u0131d\u0131r ve sitenizin g\u00fcvenlik ba\u015fl\u0131klar\u0131n\u0131 otomatik olarak kontrol edebilir.<\/li>\n<li><strong>Taray\u0131c\u0131 Geli\u015ftirici Ara\u00e7lar\u0131<\/strong>: Taray\u0131c\u0131n\u0131z\u0131n geli\u015ftirici ara\u00e7lar\u0131ndaki \"Network\" (A\u011f) sekmesi alt\u0131nda, HTTP yan\u0131t ba\u015fl\u0131klar\u0131n\u0131 manuel olarak kontrol edebilirsiniz. CSP ihlalleri genellikle \"Console\" (Konsol) sekmesinde g\u00f6r\u00fcn\u00fcr.<\/li>\n<li><strong>CSP Evaluators<\/strong>: CSP'nizi yay\u0131nlamadan \u00f6nce potansiyel g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 veya yap\u0131land\u0131rma hatalar\u0131n\u0131 tespit etmenize yard\u0131mc\u0131 olur.<\/li>\n<\/ul>\n<h3>Vaka Analizi: B\u00fcy\u00fck Bir Medya Kurulu\u015funun Ba\u015fl\u0131k Optimizasyonu<\/h3>\n<p>B\u00fcy\u00fck bir \u00e7evrimi\u00e7i medya kurulu\u015fu, Cloudflare \u00fczerinde kapsaml\u0131 bir g\u00fcvenlik ba\u015fl\u0131\u011f\u0131 uygulamas\u0131 ba\u015flatt\u0131. Sitenin boyutu ve \u00e7ok say\u0131da \u00fc\u00e7\u00fcnc\u00fc taraf entegrasyonu (reklam a\u011flar\u0131, analiz ara\u00e7lar\u0131, sosyal medya widget'lar\u0131) nedeniyle ba\u015flang\u0131\u00e7ta CSP'yi y\u00f6netmek \u00e7ok zordu. Report-only modunda aylarca \u00e7al\u0131\u015ft\u0131ktan sonra, Cloudflare Transform Rules kullanarak, belirli URL yollar\u0131na g\u00f6re farkl\u0131 CSP'ler uygulamaya ba\u015flad\u0131lar. \u00d6rne\u011fin, kullan\u0131c\u0131 profili sayfalar\u0131 i\u00e7in daha kat\u0131 bir CSP, ana sayfa i\u00e7in ise reklamlar nedeniyle biraz daha gev\u015fek ancak yine de g\u00fcvenli bir CSP uygulad\u0131lar. Ayr\u0131ca, HSTS preload listesine girerek ve <code>Permissions-Policy<\/code> ile gereksiz taray\u0131c\u0131 \u00f6zelliklerini kapatarak genel g\u00fcvenlik duru\u015flar\u0131n\u0131 \u00f6nemli \u00f6l\u00e7\u00fcde art\u0131rd\u0131lar. Bu segmentasyon, b\u00fcy\u00fck ve karma\u015f\u0131k sitelerde g\u00fcvenlik ve i\u015flevsellik aras\u0131nda denge kurman\u0131n ne kadar \u00f6nemli oldu\u011funu g\u00f6stermektedir.<\/p>\n<div class=\"expert-tip\">\n Uzman \u0130pucu: G\u00fcvenlik ba\u015fl\u0131klar\u0131 statik de\u011fildir; sitenizin geli\u015fmesiyle birlikte (yeni eklentiler, CDN'ler, reklam a\u011flar\u0131) g\u00fcncellenmeleri gerekebilir. Bu nedenle, periyodik olarak ba\u015fl\u0131klar\u0131n\u0131z\u0131 g\u00f6zden ge\u00e7irin ve g\u00fcvenlik taray\u0131c\u0131lar\u0131yla test etmeyi unutmay\u0131n.\n<\/div>\n<p>Bu ileri d\u00fczey uygulamalar ve optimizasyon ipu\u00e7lar\u0131, web sitenizin g\u00fcvenli\u011fini sadece temel seviyede tutmakla kalmaz, ayn\u0131 zamanda potansiyel sald\u0131r\u0131lara kar\u015f\u0131 daha diren\u00e7li, esnek ve gelece\u011fe d\u00f6n\u00fck bir yap\u0131ya kavu\u015fturur. Cloudflare'\u0131n sundu\u011fu esneklik ile bu geli\u015fmi\u015f politikalar\u0131 kolayca y\u00f6netebilir ve uygulayabilirsiniz.<\/p>\n<h2>Mobil Uyumluluk ve Performans: G\u00fcvenlik Ba\u015fl\u0131klar\u0131n\u0131n Rol\u00fc<\/h2>\n<p>G\u00fcn\u00fcm\u00fczde mobil cihazlar \u00fczerinden internete eri\u015fim, masa\u00fcst\u00fc bilgisayarlara k\u0131yasla \u00e7ok daha yayg\u0131n hale gelmi\u015ftir. Bu durum, web sitelerinin sadece g\u00fcvenli de\u011fil, ayn\u0131 zamanda mobil uyumlu ve h\u0131zl\u0131 olmas\u0131n\u0131 da zorunlu k\u0131lmaktad\u0131r. Peki, HTTP g\u00fcvenlik ba\u015fl\u0131klar\u0131 ile mobil uyumluluk ve performans aras\u0131nda nas\u0131l bir ili\u015fki vard\u0131r? Do\u011frudan bir kod entegrasyonu olmasa da, g\u00fcvenlik ba\u015fl\u0131klar\u0131n\u0131n dolayl\u0131 yoldan mobil deneyime ve site h\u0131z\u0131na \u00f6nemli katk\u0131lar\u0131 bulunmaktad\u0131r.<\/p>\n<h3>G\u00fcvenlik, G\u00fcven ve Kullan\u0131c\u0131 Deneyimi<\/h3>\n<p>Mobil kullan\u0131c\u0131lar, genellikle hareket halindeyken veya s\u0131n\u0131rl\u0131 a\u011f ko\u015fullar\u0131nda internete eri\u015firler. Bu durumda, bir web sitesinin h\u0131zl\u0131 y\u00fcklenmesi ve sorunsuz \u00e7al\u0131\u015fmas\u0131 kritik \u00f6neme sahiptir. G\u00fcvenlik ba\u015fl\u0131klar\u0131, sitenizi \u00e7e\u015fitli siber tehditlerden koruyarak dolayl\u0131 yoldan bu deneyime katk\u0131da bulunur. \u00d6rne\u011fin, bir XSS sald\u0131r\u0131s\u0131 sonucu sitenize k\u00f6t\u00fc ama\u00e7l\u0131 betikler enjekte edilirse, bu betikler performans\u0131 d\u00fc\u015f\u00fcrebilir, sayfalar\u0131n yava\u015f y\u00fcklenmesine neden olabilir veya hatta mobil cihaz\u0131n pilini h\u0131zl\u0131ca t\u00fcketebilir. Content-Security-Policy gibi ba\u015fl\u0131klar, bu t\u00fcr betiklerin \u00e7al\u0131\u015fmas\u0131n\u0131 engelleyerek sitenizin orijinal performans\u0131n\u0131 korumas\u0131na yard\u0131mc\u0131 olur.<\/p>\n<p>Ayr\u0131ca, HSTS ba\u015fl\u0131\u011f\u0131 sayesinde siteniz her zaman HTTPS \u00fczerinden y\u00fcklenir. HTTPS, modern web standartlar\u0131na uygun olman\u0131n yan\u0131 s\u0131ra, mobil cihazlarda \u00f6zellikle g\u00fcvensiz Wi-Fi a\u011flar\u0131nda veri g\u00fcvenli\u011fini sa\u011flar. Kullan\u0131c\u0131lar\u0131n verilerinin \u015fifrelenmi\u015f oldu\u011funu bilmeleri, mobil sitenizle etkile\u015fim kurarken duyduklar\u0131 g\u00fcveni art\u0131r\u0131r. G\u00fcvenli bir site, kullan\u0131c\u0131lar\u0131n ki\u015fisel bilgilerini girmeleri veya \u00f6deme yapmalar\u0131 konusunda daha isteklidirler, bu da mobil d\u00f6n\u00fc\u015f\u00fcm oranlar\u0131 \u00fczerinde olumlu bir etki yaratabilir. Mobil kullan\u0131c\u0131lar, yava\u015f veya g\u00fcvenli olmayan bir site deneyiminden kolayca vazge\u00e7me e\u011filimindedir; bu nedenle g\u00fcvenlik, kullan\u0131c\u0131 ba\u011fl\u0131l\u0131\u011f\u0131 i\u00e7in temel bir unsurdur.<\/p>\n<h3>Performans Art\u0131\u015f\u0131 ve G\u00fcvenli Kaynak Y\u00fcklemesi<\/h3>\n<p>Baz\u0131 g\u00fcvenlik ba\u015fl\u0131klar\u0131, performans \u00fczerinde do\u011frudan veya dolayl\u0131 olumlu etkilere sahip olabilir. \u00d6rne\u011fin, CSP, sitenizin yaln\u0131zca g\u00fcvenilen kaynaklardan betik ve stil y\u00fcklemesini sa\u011flayarak, potansiyel olarak yava\u015f veya k\u00f6t\u00fc ama\u00e7l\u0131 \u00fc\u00e7\u00fcnc\u00fc taraf kaynaklar\u0131n y\u00fcklenmesini engeller. Bu, sayfa y\u00fckleme s\u00fcresini h\u0131zland\u0131rabilir ve gereksiz HTTP isteklerini azaltabilir. Ayr\u0131ca, X-Content-Type-Options: nosniff ba\u015fl\u0131\u011f\u0131, taray\u0131c\u0131n\u0131n MIME t\u00fcr\u00fcn\u00fc tahmin etme \u00e7abas\u0131n\u0131 ortadan kald\u0131rarak k\u00fc\u00e7\u00fck bir performans art\u0131\u015f\u0131 sa\u011flayabilir.<\/p>\n<p>Cloudflare gibi bir CDN'in kullan\u0131lmas\u0131, g\u00fcvenlik ba\u015fl\u0131klar\u0131n\u0131n performansla birle\u015fiminde kritik bir rol oynar. Cloudflare, g\u00fcvenlik ba\u015fl\u0131klar\u0131n\u0131 global a\u011f\u0131 \u00fczerinden da\u011f\u0131tarak, sunucunuzun her bir istek i\u00e7in bu ba\u015fl\u0131klar\u0131 dinamik olarak eklemesi y\u00fck\u00fcn\u00fc hafifletir. Bu, daha h\u0131zl\u0131 yan\u0131t s\u00fcreleri ve daha iyi bir mobil deneyim anlam\u0131na gelir. Edge a\u011f\u0131nda uygulanan kurallar, sitenizin \u00e7ekirdek sunucusuna ula\u015fmadan \u00f6nce yan\u0131t ba\u015fl\u0131klar\u0131n\u0131 de\u011fi\u015ftirir, bu da gecikmeyi minimize eder.<\/p>\n<h3>Kapsaml\u0131 Bir Yakla\u015f\u0131m: G\u00fcvenlik ve Responsive Tasar\u0131m<\/h3>\n<p>G\u00fcvenlik ba\u015fl\u0131klar\u0131, mobil uyumlulu\u011fun sadece bir par\u00e7as\u0131d\u0131r. Tamamen mobil uyumlu bir deneyim i\u00e7in, responsive (duyarl\u0131) tasar\u0131m teknikleri ve mobil cihazlara \u00f6zel optimizasyonlar da \u015fartt\u0131r. Bu, g\u00fcvenlik ba\u015fl\u0131klar\u0131 ile birlikte kullan\u0131ld\u0131\u011f\u0131nda, hem g\u00fcvenli hem de eri\u015filebilir bir web sitesi olu\u015fturman\u0131n anahtar\u0131d\u0131r. \u00d6rne\u011fin, CSS'deki media query'ler, sitenizin farkl\u0131 ekran boyutlar\u0131na ve \u00e7\u00f6z\u00fcn\u00fcrl\u00fcklerine g\u00f6re kendini otomatik olarak ayarlamas\u0131n\u0131 sa\u011flar. Bu, do\u011frudan g\u00fcvenlik ba\u015fl\u0131klar\u0131yla ilgili olmasa da, bir b\u00fct\u00fcn olarak modern ve g\u00fcvenli bir web sitesinin olmazsa olmaz\u0131d\u0131r.<\/p>\n<pre><code class=\"language-css\">\n\/* Mobil cihazlar i\u00e7in stil tan\u0131mlar\u0131 *\/\n@media screen and (max-width: 768px) {\n body {\n font-size: 14px;\n }\n .main-navigation ul {\n flex-direction: column;\n }\n .hero-banner {\n height: 200px;\n }\n}\n<\/pre>\n<p><\/code><\/p>\n<p>Yukar\u0131daki CSS kodu, mobil cihazlar i\u00e7in temel bir duyarl\u0131 tasar\u0131m \u00f6rne\u011fini g\u00f6stermektedir. Bu t\u00fcr kodlar, g\u00fcvenlik ba\u015fl\u0131klar\u0131yla do\u011frudan ba\u011flant\u0131l\u0131 olmasa da, genel bir web sitesinin kullan\u0131c\u0131 deneyimini ve eri\u015filebilirli\u011fini art\u0131rarak sitenin de\u011ferini y\u00fckseltir. G\u00fcvenlik ba\u015fl\u0131klar\u0131, bu deneyimin temelini olu\u015fturan g\u00f6r\u00fcnmez bir koruma katman\u0131 sa\u011flar.<\/p>\n<div class=\"expert-tip\">\n Uzman \u0130pucu: Mobil cihazlar genellikle daha az i\u015flem g\u00fcc\u00fcne ve s\u0131n\u0131rl\u0131 bant geni\u015fli\u011fine sahiptir. G\u00fcvenlik ba\u015fl\u0131klar\u0131n\u0131z, gereksiz kaynaklar\u0131n y\u00fcklenmesini engelleyerek veya zararl\u0131 betiklerin \u00e7al\u0131\u015fmas\u0131n\u0131 durdurarak, bu s\u0131n\u0131rlamalar alt\u0131nda bile sitenizin daha iyi performans g\u00f6stermesine yard\u0131mc\u0131 olabilir.\n<\/div>\n<p>Sonu\u00e7 olarak, HTTP g\u00fcvenlik ba\u015fl\u0131klar\u0131, mobil uyumluluk ve performans\u0131n temelini olu\u015fturan \u00f6nemli bir g\u00fcvenlik katman\u0131 sa\u011flar. G\u00fcvenli bir web sitesi, h\u0131zl\u0131 ve g\u00fcvenilir bir mobil deneyim sunarak kullan\u0131c\u0131 memnuniyetini art\u0131r\u0131r ve sitenizin genel ba\u015far\u0131s\u0131na katk\u0131da bulunur. Cloudflare ile bu ba\u015fl\u0131klar\u0131 verimli bir \u015fekilde y\u00f6netmek, hem g\u00fcvenlik hem de performans a\u00e7\u0131s\u0131ndan \u00f6nemli avantajlar sunar.<\/p>\n<h2>Web G\u00fcvenli\u011finde Kal\u0131c\u0131 Bir Ad\u0131m: G\u00fcvenlik Ba\u015fl\u0131klar\u0131<\/h2>\n<p>Bu kapsaml\u0131 rehber boyunca, HTTP g\u00fcvenlik ba\u015fl\u0131klar\u0131n\u0131n web sitenizin savunma stratejisindeki kritik rol\u00fcn\u00fc, her bir ba\u015fl\u0131\u011f\u0131n ne anlama geldi\u011fini ve Cloudflare gibi modern bir CDN arac\u0131l\u0131\u011f\u0131yla nas\u0131l kolayca uygulanabilece\u011fini detayl\u0131ca inceledik. Dijital d\u00fcnyadaki tehditler s\u00fcrekli geli\u015firken, g\u00fcvenlik ba\u015fl\u0131klar\u0131 taray\u0131c\u0131 tabanl\u0131 sald\u0131r\u0131lara (XSS, Clickjacking, MIME Sniffing vb.) kar\u015f\u0131 ilk ve en \u00f6nemli savunma hatlar\u0131ndan birini olu\u015fturur. Bu ba\u015fl\u0131klar\u0131 do\u011fru bir \u015fekilde yap\u0131land\u0131rmak, sadece web sitenizin teknik g\u00fcvenli\u011fini art\u0131rmakla kalmaz, ayn\u0131 zamanda kullan\u0131c\u0131lar\u0131n\u0131za olan taahh\u00fcd\u00fcn\u00fcz\u00fc g\u00f6stererek dijital varl\u0131\u011f\u0131n\u0131za olan g\u00fcveni de peki\u015ftirir.<\/p>\n<p>Cloudflare'\u0131n \"Transform Rules\" \u00f6zelli\u011fi, g\u00fcvenlik ba\u015fl\u0131klar\u0131n\u0131 sunucu seviyesinde karma\u015f\u0131k yap\u0131land\u0131rmalara girmeden, kullan\u0131c\u0131 dostu bir aray\u00fcz \u00fczerinden eklemenin ve y\u00f6netmenin ne kadar pratik ve verimli oldu\u011funu g\u00f6zler \u00f6n\u00fcne sermi\u015ftir. Bu sayede, Content-Security-Policy (CSP) gibi karma\u015f\u0131k ba\u015fl\u0131klar bile, sitenizin ihtiya\u00e7lar\u0131na g\u00f6re uyarlanabilir ve da\u011f\u0131t\u0131labilir. HSTS preloading, Permissions-Policy gibi ileri d\u00fczey uygulamalar ve s\u00fcrekli izleme, test ara\u00e7lar\u0131 kullanma ve raporlama mekanizmalar\u0131n\u0131 entegre etme gibi ipu\u00e7lar\u0131yla, g\u00fcvenlik duru\u015funuzu daha da g\u00fc\u00e7lendirebilirsiniz. Unutmay\u0131n ki g\u00fcvenlik, tek seferlik bir i\u015flem de\u011fil, s\u00fcrekli bir s\u00fcre\u00e7tir. Web sitenizin ve bar\u0131nd\u0131rd\u0131\u011f\u0131 verilerin g\u00fcvenli\u011fini sa\u011flamak i\u00e7in d\u00fczenli g\u00fcncellemeler, izleme ve g\u00fcvenlik politikalar\u0131n\u0131z\u0131n g\u00f6zden ge\u00e7irilmesi hayati \u00f6nem ta\u015f\u0131r.<\/p>\n<p>\u00d6zetle, HTTP g\u00fcvenlik ba\u015fl\u0131klar\u0131, modern bir web sitesi i\u00e7in art\u0131k \"olmas\u0131 g\u00fczel\" de\u011fil, \"olmazsa olmaz\" bir unsurdur. Bunlar\u0131 do\u011fru bir \u015fekilde uygulamak ve Cloudflare gibi g\u00fc\u00e7l\u00fc bir platformla y\u00f6netmek, sitenizi siber tehditlere kar\u015f\u0131 daha diren\u00e7li hale getirir, kullan\u0131c\u0131 deneyimini iyile\u015ftirir ve genel dijital g\u00fcvenli\u011finize \u00f6nemli katk\u0131lar sa\u011flar. Bu rehberin, web sitenizin g\u00fcvenli\u011fini bir ad\u0131m \u00f6teye ta\u015f\u0131man\u0131z i\u00e7in size yol g\u00f6sterdi\u011fini umuyoruz.<\/p>\n<h3>S\u0131k\u00e7a Sorulan Sorular<\/h3>\n<dl>\n<dt>G\u00fcvenlik ba\u015fl\u0131klar\u0131n\u0131 uygulamak sitemi yava\u015flat\u0131r m\u0131?<\/dt>\n<dd>Hay\u0131r, aksine bir\u00e7ok durumda sitenizin performans\u0131na olumlu katk\u0131da bulunabilirler. \u00d6rne\u011fin, zararl\u0131 betiklerin y\u00fcklenmesini engelleyerek veya taray\u0131c\u0131n\u0131n gereksiz i\u015flemleri yapmas\u0131n\u0131 \u00f6nleyerek performans\u0131 art\u0131rabilirler. Cloudflare gibi bir CDN \u00fczerinden uyguland\u0131\u011f\u0131nda, ba\u015fl\u0131klar\u0131n eklenmesi neredeyse an\u0131nda ger\u00e7ekle\u015fir ve ek y\u00fck getirmez.<\/dd>\n<dt>HSTS nedir ve neden \u00f6nemlidir?<\/dt>\n<dd>HSTS (HTTP Strict Transport Security), taray\u0131c\u0131lara sitenizle sadece HTTPS \u00fczerinden ileti\u015fim kurmalar\u0131n\u0131 emreden bir g\u00fcvenlik ba\u015fl\u0131\u011f\u0131d\u0131r. Bu, ortadaki adam (man-in-the-middle) sald\u0131r\u0131lar\u0131n\u0131 ve SSL stripping gibi tehditleri \u00f6nler. Kullan\u0131c\u0131lar\u0131n her zaman g\u00fcvenli, \u015fifreli bir ba\u011flant\u0131 \u00fczerinden sitenize eri\u015fmesini sa\u011flayarak veri b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc ve gizlili\u011fini korur.<\/dd>\n<dt>CSP olu\u015ftururken nelere dikkat etmeliyim?<\/dt>\n<dd>CSP (Content-Security-Policy) olu\u015ftururken sitenizin kulland\u0131\u011f\u0131 t\u00fcm kaynaklar\u0131 (betikler, stiller, resimler, fontlar, videolar vb.) do\u011fru bir \u015fekilde tan\u0131mlaman\u0131z kritiktir. Ba\u015flang\u0131\u00e7ta <code>report-only<\/code> modunda test ederek potansiyel ihlalleri izleyin. Gereksiz <code>unsafe-inline<\/code> veya <code>unsafe-eval<\/code> gibi direktiflerden ka\u00e7\u0131n\u0131n ve yaln\u0131zca g\u00fcvendi\u011finiz kaynaklara izin verin. Yava\u015f yava\u015f k\u0131s\u0131tlamalar\u0131 art\u0131rarak sa\u011flam bir politika olu\u015fturun.<\/dd>\n<dt>T\u00fcm g\u00fcvenlik ba\u015fl\u0131klar\u0131n\u0131 kullanmak zorunda m\u0131y\u0131m?<\/dt>\n<dd>Her ne kadar t\u00fcm g\u00fcvenlik ba\u015fl\u0131klar\u0131n\u0131 kullanmak en iyi uygulama olsa da, her sitenin farkl\u0131 ihtiya\u00e7lar\u0131 olabilir. Ancak HSTS, X-Frame-Options, X-Content-Type-Options ve bir ba\u015flang\u0131\u00e7 CSP'si gibi temel ba\u015fl\u0131klar, \u00e7o\u011fu web sitesi i\u00e7in mutlak surette uygulanmas\u0131 gerekenler aras\u0131ndad\u0131r. Kendi sitenizin risk profiline ve ihtiya\u00e7lar\u0131na g\u00f6re bir \u00f6nceliklendirme yapabilirsiniz.<\/dd>\n<dt>G\u00fcvenlik ba\u015fl\u0131klar\u0131m\u0131 test etmek i\u00e7in hangi ara\u00e7lar\u0131 kullanabilirim?<\/dt>\n<dd>Ba\u015fl\u0131klar\u0131n\u0131z\u0131 test etmek i\u00e7in <a href=\"https:\/\/securityheaders.com\/\" target=\"_blank\" rel=\"noopener noreferrer\">SecurityHeaders.com<\/a> gibi \u00e7evrimi\u00e7i ara\u00e7lar\u0131 kullanabilirsiniz. Taray\u0131c\u0131n\u0131z\u0131n geli\u015ftirici ara\u00e7lar\u0131ndaki \"Network\" sekmesinden HTTP yan\u0131t ba\u015fl\u0131klar\u0131n\u0131 manuel olarak kontrol edebilir ve \"Console\" sekmesinden CSP ihlallerini g\u00f6zlemleyebilirsiniz. Ayr\u0131ca OWASP ZAP gibi g\u00fcvenlik test ara\u00e7lar\u0131 da otomatik kontroller sa\u011flayabilir.<\/dd>\n<\/dl>\n<p><\/body><\/p>\n","protected":false},"excerpt":{"rendered":"Web sitenizin \u00e7evrimi\u00e7i g\u00fcvenli\u011fini art\u0131rmak i\u00e7in Cloudflare \u00fczerinden HTTP g\u00fcvenlik ba\u015fl\u0131klar\u0131 nas\u0131l eklenir? Bu kapsaml\u0131 rehber, taray\u0131c\u0131 tabanl\u0131…","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[1341],"tags":[],"class_list":{"0":"post-33159","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-cloud","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\n<title>Cloudflare ile G\u00fcvenlik Ba\u015fl\u0131klar\u0131 Ekleme: Kapsaml\u0131 Rehber<\/title>\n<meta name=\"description\" content=\"Web sitenizin \u00e7evrimi\u00e7i g\u00fcvenli\u011fini art\u0131rmak i\u00e7in Cloudflare \u00fczerinden HTTP g\u00fcvenlik ba\u015fl\u0131klar\u0131 nas\u0131l eklenir? Bu kapsaml\u0131 rehber, taray\u0131c\u0131 tabanl\u0131 sald\u0131r\u0131lara kar\u015f\u0131 g\u00fc\u00e7l\u00fc bir koruma kalkan\u0131 olu\u015fturan bu kritik ba\u015fl\u0131klar\u0131 ad\u0131m ad\u0131m yap\u0131land\u0131rmay\u0131 ve web sitenizi daha g\u00fcvenli hale getirmeyi detayl\u0131ca a\u00e7\u0131kl\u0131yor. Dijital varl\u0131\u011f\u0131n\u0131z\u0131 koruma alt\u0131na al\u0131n.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/cloudflare-ile-guvenlik-basliklari-ekleme-kapsamli-rehber\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Cloudflare ile G\u00fcvenlik Ba\u015fl\u0131klar\u0131 Ekleme: Kapsaml\u0131 Rehber\" \/>\n<meta property=\"og:description\" content=\"Web sitenizin \u00e7evrimi\u00e7i g\u00fcvenli\u011fini art\u0131rmak i\u00e7in Cloudflare \u00fczerinden HTTP g\u00fcvenlik ba\u015fl\u0131klar\u0131 nas\u0131l eklenir? Bu kapsaml\u0131 rehber, taray\u0131c\u0131 tabanl\u0131 sald\u0131r\u0131lara kar\u015f\u0131 g\u00fc\u00e7l\u00fc bir koruma kalkan\u0131 olu\u015fturan bu kritik ba\u015fl\u0131klar\u0131 ad\u0131m ad\u0131m yap\u0131land\u0131rmay\u0131 ve web sitenizi daha g\u00fcvenli hale getirmeyi detayl\u0131ca a\u00e7\u0131kl\u0131yor. Dijital varl\u0131\u011f\u0131n\u0131z\u0131 koruma alt\u0131na al\u0131n.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/cloudflare-ile-guvenlik-basliklari-ekleme-kapsamli-rehber\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2025-10-30T08:01:52+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"29 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/cloudflare-ile-guvenlik-basliklari-ekleme-kapsamli-rehber\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/cloudflare-ile-guvenlik-basliklari-ekleme-kapsamli-rehber\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"Cloudflare ile G\u00fcvenlik Ba\u015fl\u0131klar\u0131 Ekleme: Kapsaml\u0131 Rehber\",\"datePublished\":\"2025-10-30T08:01:52+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/cloudflare-ile-guvenlik-basliklari-ekleme-kapsamli-rehber\/\"},\"wordCount\":5650,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"Cloud\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/cloudflare-ile-guvenlik-basliklari-ekleme-kapsamli-rehber\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/cloudflare-ile-guvenlik-basliklari-ekleme-kapsamli-rehber\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/cloudflare-ile-guvenlik-basliklari-ekleme-kapsamli-rehber\/\",\"name\":\"Cloudflare ile G\u00fcvenlik Ba\u015fl\u0131klar\u0131 Ekleme: Kapsaml\u0131 Rehber\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2025-10-30T08:01:52+00:00\",\"description\":\"Web sitenizin \u00e7evrimi\u00e7i g\u00fcvenli\u011fini art\u0131rmak i\u00e7in Cloudflare \u00fczerinden HTTP g\u00fcvenlik ba\u015fl\u0131klar\u0131 nas\u0131l eklenir? Bu kapsaml\u0131 rehber, taray\u0131c\u0131 tabanl\u0131 sald\u0131r\u0131lara kar\u015f\u0131 g\u00fc\u00e7l\u00fc bir koruma kalkan\u0131 olu\u015fturan bu kritik ba\u015fl\u0131klar\u0131 ad\u0131m ad\u0131m yap\u0131land\u0131rmay\u0131 ve web sitenizi daha g\u00fcvenli hale getirmeyi detayl\u0131ca a\u00e7\u0131kl\u0131yor. Dijital varl\u0131\u011f\u0131n\u0131z\u0131 koruma alt\u0131na al\u0131n.\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/cloudflare-ile-guvenlik-basliklari-ekleme-kapsamli-rehber\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/cloudflare-ile-guvenlik-basliklari-ekleme-kapsamli-rehber\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/cloudflare-ile-guvenlik-basliklari-ekleme-kapsamli-rehber\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cloudflare ile G\u00fcvenlik Ba\u015fl\u0131klar\u0131 Ekleme: Kapsaml\u0131 Rehber\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n","yoast_head_json":{"title":"Cloudflare ile G\u00fcvenlik Ba\u015fl\u0131klar\u0131 Ekleme: Kapsaml\u0131 Rehber","description":"Web sitenizin \u00e7evrimi\u00e7i g\u00fcvenli\u011fini art\u0131rmak i\u00e7in Cloudflare \u00fczerinden HTTP g\u00fcvenlik ba\u015fl\u0131klar\u0131 nas\u0131l eklenir? Bu kapsaml\u0131 rehber, taray\u0131c\u0131 tabanl\u0131 sald\u0131r\u0131lara kar\u015f\u0131 g\u00fc\u00e7l\u00fc bir koruma kalkan\u0131 olu\u015fturan bu kritik ba\u015fl\u0131klar\u0131 ad\u0131m ad\u0131m yap\u0131land\u0131rmay\u0131 ve web sitenizi daha g\u00fcvenli hale getirmeyi detayl\u0131ca a\u00e7\u0131kl\u0131yor. Dijital varl\u0131\u011f\u0131n\u0131z\u0131 koruma alt\u0131na al\u0131n.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/cloudflare-ile-guvenlik-basliklari-ekleme-kapsamli-rehber\/","og_locale":"tr_TR","og_type":"article","og_title":"Cloudflare ile G\u00fcvenlik Ba\u015fl\u0131klar\u0131 Ekleme: Kapsaml\u0131 Rehber","og_description":"Web sitenizin \u00e7evrimi\u00e7i g\u00fcvenli\u011fini art\u0131rmak i\u00e7in Cloudflare \u00fczerinden HTTP g\u00fcvenlik ba\u015fl\u0131klar\u0131 nas\u0131l eklenir? Bu kapsaml\u0131 rehber, taray\u0131c\u0131 tabanl\u0131 sald\u0131r\u0131lara kar\u015f\u0131 g\u00fc\u00e7l\u00fc bir koruma kalkan\u0131 olu\u015fturan bu kritik ba\u015fl\u0131klar\u0131 ad\u0131m ad\u0131m yap\u0131land\u0131rmay\u0131 ve web sitenizi daha g\u00fcvenli hale getirmeyi detayl\u0131ca a\u00e7\u0131kl\u0131yor. Dijital varl\u0131\u011f\u0131n\u0131z\u0131 koruma alt\u0131na al\u0131n.","og_url":"https:\/\/fatihsoysal.com\/blog\/cloudflare-ile-guvenlik-basliklari-ekleme-kapsamli-rehber\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2025-10-30T08:01:52+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"29 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/cloudflare-ile-guvenlik-basliklari-ekleme-kapsamli-rehber\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/cloudflare-ile-guvenlik-basliklari-ekleme-kapsamli-rehber\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"Cloudflare ile G\u00fcvenlik Ba\u015fl\u0131klar\u0131 Ekleme: Kapsaml\u0131 Rehber","datePublished":"2025-10-30T08:01:52+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/cloudflare-ile-guvenlik-basliklari-ekleme-kapsamli-rehber\/"},"wordCount":5650,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["Cloud"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/cloudflare-ile-guvenlik-basliklari-ekleme-kapsamli-rehber\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/cloudflare-ile-guvenlik-basliklari-ekleme-kapsamli-rehber\/","url":"https:\/\/fatihsoysal.com\/blog\/cloudflare-ile-guvenlik-basliklari-ekleme-kapsamli-rehber\/","name":"Cloudflare ile G\u00fcvenlik Ba\u015fl\u0131klar\u0131 Ekleme: Kapsaml\u0131 Rehber","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2025-10-30T08:01:52+00:00","description":"Web sitenizin \u00e7evrimi\u00e7i g\u00fcvenli\u011fini art\u0131rmak i\u00e7in Cloudflare \u00fczerinden HTTP g\u00fcvenlik ba\u015fl\u0131klar\u0131 nas\u0131l eklenir? Bu kapsaml\u0131 rehber, taray\u0131c\u0131 tabanl\u0131 sald\u0131r\u0131lara kar\u015f\u0131 g\u00fc\u00e7l\u00fc bir koruma kalkan\u0131 olu\u015fturan bu kritik ba\u015fl\u0131klar\u0131 ad\u0131m ad\u0131m yap\u0131land\u0131rmay\u0131 ve web sitenizi daha g\u00fcvenli hale getirmeyi detayl\u0131ca a\u00e7\u0131kl\u0131yor. Dijital varl\u0131\u011f\u0131n\u0131z\u0131 koruma alt\u0131na al\u0131n.","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/cloudflare-ile-guvenlik-basliklari-ekleme-kapsamli-rehber\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/cloudflare-ile-guvenlik-basliklari-ekleme-kapsamli-rehber\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/cloudflare-ile-guvenlik-basliklari-ekleme-kapsamli-rehber\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Cloudflare ile G\u00fcvenlik Ba\u015fl\u0131klar\u0131 Ekleme: Kapsaml\u0131 Rehber"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/33159","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=33159"}],"version-history":[{"count":0,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/33159\/revisions"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=33159"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=33159"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=33159"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}