How can I prevent burp suite professional and are there any tips to more protection

[samehdoush]

How can I prevent burp suite professional and are there any tips to more protection

laravel : 9.41.0
inertiajs/inertia-laravel: v0.6.4 // with vue 3

I add to header :

  $Nonce = "'nonce-".Vite::cspNonce()."'";
           $response->headers->set('Referrer-Policy', 'no-referrer-when-downgrade');
            $response->headers->set('X-XSS-Protection', '1; mode=block');
            $response->headers->set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload');
            $response->headers->set('Content-Security-Policy', "default-src 'self' $Nonce; script-src data: 'self'  $sites $Nonce ajax.cloudflare.com  plausible.io/js/plausible.js utteranc.es/client.js; style-src 'self' $sites 'unsafe-inline'; img-src 'self' $sites * data: blob:; font-src 'self' $sites data: ; connect-src 'self'  plausible.io/api/event; media-src 'self' * blob:; object-src 'none'; base-uri 'self'; frame-src 'self' $sites ; worker-src 'self' blob: $sites");
            $response->headers->set('Expect-CT', 'enforce, max-age=30');
            $response->headers->set('Permissions-Policy', 'autoplay=(self), camera=(), encrypted-media=(self), fullscreen=(), geolocation=(self), gyroscope=(self), magnetometer=(), microphone=(), midi=(), payment=(), sync-xhr=(self), usb=()');
            $response->headers->set('X-Frame-Options', 'DENY');
            $response->headers->set('Access-Control-Allow-Methods', 'GET,POST,PUT,DELETE');
            $response->headers->set('Access-Control-Allow-Headers', 'Content-Type,Authorization,X-Requested-With,X-CSRF-Token,x-api-key');
            $unwantedHeaders = ['X-Powered-By', 'server', 'Server'];
            $this->removeUnwantedHeaders($this->unwantedHeaders);



 private function removeUnwantedHeaders($headers): void
    {
        foreach ($headers as $header) {
            header_remove($header);
        }
    }

---

I also use cloudflare pro plan
and enable

Security / Settings ->
Security Level : High
Challenge Passage : 15 min
Browser Integrity Check : true
Privacy Pass Support : true

---

Security / Bot ->

Definitely automated : Managed Challenge
Verified bots : Allow
Static resource protection : true
JavaScript Detections : true

---

SSL/TLS : Full (strict)
Minimum TLS Version : TLS 1.3

Are there any other additions or anything through which I can add more protection?
Can I prevent burp suite professional from changing sessions and hacking attempts?
Please help even with a little information

[lrljoe]

Little confused. BurpSuite is a tool for pentesting.

Blocking it won't make any underlying issues go away? And any adept user of BurpSuite will be able to bypass most mechanisms you try to block them with.

What're you trying to achieve?

[samehdoush]

Thank you for the clarification
I am trying to increase the level of protection on the site

[lrljoe]

Look at the free instance of enlightn as a first step.

https://securityheaders.com/ for your security headers

For generating a good CSP policy look at ReportURI to help you mitigate attack vectors.

Give your WAF of choice a go, CloudFlare have a free offering that is pretty decent

Get regular pentests against your site by a professional, ideally an org with some code review experts to give you a combined view and proper mitigation plan.

Have a responsible disclosure policy, make it public and easy and engage with relevant communities