HSTS missing or too short
Checks the Strict-Transport-Security header (at least 180 days).
Recommended next step if found
Send Strict-Transport-Security: max-age=31536000; includeSubDomains on HTTPS responses.
Security response headers
Headers configure browser protections and information-sharing behavior. They are useful defense-in-depth signals rather than a complete security assessment.
Related public checks
The following checks provide related public observations. Their presence does not mean this entire topic has been tested or that the application is secure.
Weak or missing Content Security Policy
Checks for a Content-Security-Policy that blocks inline scripts. Severity rises when the page has a login.
Recommended next step if found
Add a Content-Security-Policy that lists allowed script sources and avoids 'unsafe-inline' (use nonces or hashes instead). Start with Content-Security-Policy-Report-Only to test.
Clickjacking protection missing
Checks for frame-ancestors in CSP or X-Frame-Options. Severity rises when the page has a login.
Recommended next step if found
Send Content-Security-Policy: frame-ancestors 'self' (or X-Frame-Options: SAMEORIGIN for older browsers).
Keep the scope.
A blocked or unfinished check remains unverified. Review technical recommendations with the person operating the website and test changes before applying them to a live service.
Read the full methodology