Check explainer
Security headers
HSTS, X-Frame-Options, and CSP are the security baseline every audit checks.
- to review
- ok
What we check
Checks HSTS, X-Frame-Options, and Content-Security-Policy in the response headers.
Why it matters
HSTS, X-Frame-Options, and CSP are the security baseline every audit checks.
Common causes
- The host ships default headers, nobody ever configured a security policy.
- A CSP existed but was removed entirely after frontend errors instead of being repaired.
- Proxy or CDN overwrite the headers set by the backend on delivery.
How to fix it
Configure HSTS + CSP with frame-ancestors, then target securityheaders.com grade B.
What does a failing Security headers finding mean?
HSTS, X-Frame-Options, and CSP are the security baseline every audit checks. Configure HSTS + CSP with frame-ancestors, then target securityheaders.com grade B.
How do you fix Security headers?
Configure HSTS + CSP with frame-ancestors, then target securityheaders.com grade B.