Security Headers Check
Review the response headers that reduce clickjacking, content injection, data leakage, and unsafe transport behavior.
Check your websiteWhy this check matters
Headers such as Content-Security-Policy and Strict-Transport-Security add browser-enforced defenses. They complement secure application code rather than replacing it.
Passing evidence
Content-Security-Policy: default-src 'self'; frame-ancestors 'none'
X-Content-Type-Options: nosniffCommon failing evidence
X-Powered-By: Framework
Access-Control-Allow-Origin: *Possible false positives
- A strict policy must be tailored to the scripts and services the page actually uses.
- HSTS should be enabled only after HTTPS works across the intended host scope.
How to fix it safely
- Inventory required origins before writing a CSP.
- Add headers at the edge or application response layer.
- Roll out restrictive policies with monitoring and a rollback path.
How to verify the fix
- Inspect the final document response after redirects.
- Exercise critical user flows and check the browser console for policy violations.
Related Security checks
Run the complete audit
Check this signal together with the related category evidence on the current public page.
Open the security audit tool
