Security
Security headers of the site’s responses.
Clickjacking protection is missing
Section titled “Clickjacking protection is missing”security.header.clickjacking_protection_missing · Issue · Severity: Medium
Why it matters. Without frame restrictions, another site may embed the page and trick users into interacting with concealed controls.
How to fix. Add X-Frame-Options or CSP frame-ancestors where platform controls allow it.
The X-Content-Type-Options header is missing
Section titled “The X-Content-Type-Options header is missing”security.header.content_type_options_missing · Issue · Severity: Medium
Why it matters. Without MIME sniffing protection, browsers may interpret a response as a different content type and expose avoidable script-execution risks.
How to fix. Send X-Content-Type-Options: nosniff where the hosting platform allows it.
The X-Content-Type-Options value is not nosniff
Section titled “The X-Content-Type-Options value is not nosniff”security.header.content_type_options_weak · Issue · Severity: Medium
Why it matters. A weak or malformed MIME sniffing policy may not provide the browser protection the header is intended to enforce.
How to fix. Replace the weak or malformed policy with X-Content-Type-Options: nosniff.
The Content-Security-Policy header is missing
Section titled “The Content-Security-Policy header is missing”security.header.csp_missing · Issue · Severity: Low
Why it matters. A Content Security Policy can limit the sources allowed to execute or load; without one, successful content injection has fewer browser-level restrictions.
How to fix. Evaluate a CSP policy where the hosting environment supports it; otherwise document the hosting limitation and residual risk.
The Strict-Transport-Security header is missing
Section titled “The Strict-Transport-Security header is missing”security.header.hsts_missing · Issue · Severity: High
Why it matters. Without HSTS, a browser can initially attempt an insecure connection before being redirected, leaving room for downgrade or interception attacks.
How to fix. Enable HSTS where the hosting platform supports it and confirm the policy on the production domain.
The Permissions-Policy header is missing
Section titled “The Permissions-Policy header is missing”security.header.permissions_policy_missing · Issue · Severity: Low
Why it matters. Without a permissions policy, embedded or third-party content may have broader access to browser features than the site intends.
How to fix. Add a Permissions-Policy header when the platform and project requirements support it.
The Referrer-Policy header is missing
Section titled “The Referrer-Policy header is missing”security.header.referrer_policy_missing · Issue · Severity: Low
Why it matters. Without an explicit referrer policy, destination sites may receive more information about the originating URL than the project intends to disclose.
How to fix. Consider an explicit Referrer-Policy such as strict-origin-when-cross-origin.