Security Headers Checker / Headers
Security headers explained
One page per header: what it does, the value to send with a snippet for 32 platforms, how our grade counts it, and what it can break.
- Content-Security-PolicyCSP tells the browser which sources may provide scripts, styles, images, frames and connections for the page.
- Strict-Transport-SecurityHSTS tells the browser to use HTTPS for this host for max-age seconds, even when someone types http:// or follows an old link, so the first request cannot be intercepted and downgraded.
- X-Frame-OptionsA site that frames your page can lay invisible buttons over it and trick visitors into clicking yours (clickjacking).
- X-Content-Type-Optionsnosniff stops the browser from guessing a file's type from its contents.
- Referrer-PolicyWhen a visitor follows a link or loads a resource, the browser may tell the other site which page they came from.
- Permissions-PolicyPermissions-Policy decides which browser features (camera, microphone, geolocation, payment, USB, fullscreen…) the page and the frames inside it may use.
- Cross-Origin-Opener-PolicyCOOP puts your page in its own browsing context group, so another site that opened your page (or that you opened) cannot reach into your window.
- Cross-Origin-Resource-PolicyCORP tells the browser which sites may load this response into their pages (an image, a script, a JSON file).
- Cross-Origin-Embedder-PolicyCOEP makes the page refuse cross-origin resources that have not opted in (with CORP or CORS).
- Reporting-EndpointsReporting-Endpoints names URLs the browser sends reports to; CSP's report-to directive picks one by name.
- Integrity-PolicyIntegrity-Policy: blocked-destinations=(script) tells the browser to refuse any script that does not carry an integrity attribute.
- Set-Cookie flagsA session cookie is a key to the account.
- X-XSS-ProtectionX-XSS-Protection switched on the browsers' XSS auditor, which Chrome and Edge removed and Firefox never had.
- Server and X-Powered-ByHeaders such as Server: nginx/1.18.0 or X-Powered-By: PHP/7.4 tell an attacker exactly which known vulnerabilities to try.