Missing baseline security headers

Audit check headers · worth 5 of 100 points · all checks

What the audit saw

The response lacks at least one of X-Content-Type-Options, Referrer-Policy, X-Frame-Options or a Content-Security-Policy.

Why it costs you

These are the cheap half of hardening: they stop MIME sniffing turning an uploaded file into script, stop other sites framing yours for clickjacking, and stop your URLs leaking to third parties through the Referer header.

How to find it on your site

  1. See which ones you already send 
    curl -sSI https://your-site.com/ | grep -iE 'x-content-type-options|referrer-policy|x-frame-options|content-security-policy'
  2. A safe baseline to start from 
    add_header X-Content-Type-Options nosniff always;
add_header Referrer-Policy strict-origin-when-cross-origin always;
add_header X-Frame-Options SAMEORIGIN always;
add_header Content-Security-Policy "default-src 'self'; img-src 'self' data: https:; object-src 'none'; base-uri 'self'" always;
  3. Netlify / Vercel use a header block 
    # netlify.toml
[[headers]]
  for = "/*"
  [headers.values]
    X-Content-Type-Options = "nosniff"
    Referrer-Policy = "strict-origin-when-cross-origin"

How to know it is fixed

All four present. The CSP is the one that can break a page, so ship it in report-only mode first: Content-Security-Policy-Report-Only.

The part people get wrong

A strict CSP added in one step will break inline scripts and analytics. Start with default-src 'self' and widen deliberately, watching the console.

Check it against your own site

Open an issue with your URL and a bot runs this check plus 14 others, posts the failures with the measured values, and publishes a report page: free audit. If you want the fixes applied and re-verified instead: fixed-price tiers.

Other checks

The site does not answer on the URL you gave · The page is served over plain HTTP · The TLS certificate is expired or about to exp · No mobile viewport tag · The page title is missing or the wrong length · The meta description is missing or the wrong l · The page has no H1, or more than one · Images have no alt text

All published audits · Check reference