Security headers

What we look at

Always use HTTPS (Strict-Transport-Security). Tells browsers to only ever visit you over https://. It passes when it's set for at least six months. A shorter time earns a Note, and a time of 0 counts as missing.
Content-Security-Policy. Tells browsers where your page may load scripts and other content from. A policy that only reports, without enforcing, earns a Note.
X-Content-Type-Options. Set to nosniff, it stops browsers guessing what kind of file they've been sent.
Clickjacking protection. Stops other websites showing your page inside theirs to trick people into clicking (X-Frame-Options, or frame-ancestors in your Content-Security-Policy).
Referrer-Policy. How much of your page's address is passed on when someone follows a link away. Never changes your score.
Permissions-Policy. Which browser features, like the camera or location, your site says it uses. Never changes your score.
X-XSS-Protection. An old setting browsers no longer use. It only earns a Note if it's switched on, and the report suggests removing it or setting it to 0. Never changes your score.

Why it matters

Security headers are short instructions your site sends with every page. They switch on protections already built into your visitors' browsers.

A missing header is at most a Low problem: worth fixing next time someone's working on your site, not an emergency.

In our sample report

Here's this part of our sample report for a demo website. example.com is a demonstration domain: we made up what it shows, then ran it through our real checks and report.

Sample report · example.com · illustrative data

75 out of 100. 7 of 7 checks completed

4 passed · 2 issues · 1 note

Low Strict-Transport-Security

https://example.com/ has no Strict-Transport-Security header
For you

Without HSTS, browsers only know to use HTTPS after visiting once, leaving the first visit (and any plain-HTTP link) open to interception.

What to do: Add the Strict-Transport-Security header with a max-age of at least six months (a year is common). Add includeSubDomains or preload only once every subdomain serves HTTPS.
For your IT provider

nginx
```
add_header Strict-Transport-Security "max-age=31536000" always;
```
Apache
```
Header always set Strict-Transport-Security "max-age=31536000"
```
Cloudflare
```
SSL/TLS → Edge Certificates → HTTP Strict Transport Security (HSTS): enable, with a max-age of 12 months.
```
Low Content-Security-Policy

https://example.com/ has no Content-Security-Policy
For you

Without a Content-Security-Policy, the browser has no extra limits on what scripts or resources the page can load if an injection flaw is ever found.

What to do: Start with a Content-Security-Policy in report-only mode, check the reports, then enforce it. Report-only violations only appear in the browser's developer console unless a report-to or report-uri endpoint is added to receive them. A good policy needs tailoring to the site; the example is a starting point, not a drop-in.
For your IT provider

nginx
```
add_header Content-Security-Policy-Report-Only "default-src 'self'" always;
```
Apache
```
Header always set Content-Security-Policy-Report-Only "default-src 'self'"
```
Passed X-Content-Type-Options

https://example.com/ sets X-Content-Type-Options
Passed Clickjacking protection

https://example.com/ is protected against clickjacking
Passed Referrer-Policy

https://example.com/ sets Referrer-Policy
Note Permissions-Policy

https://example.com/ has no Permissions-Policy header
Passed X-XSS-Protection

https://example.com/ does not enable the legacy X-XSS-Protection filter

Who fixes it

In your report, anything to fix in this area goes to:

Your web host or website developer.

What we can't see from outside

We read the headers on your home page only, and other pages can send different ones. If your site doesn't answer on https://, we read the plain http:// page instead, and Always use HTTPS doesn't apply.

Security headers

What we look at

Why it matters

In our sample report