The URL is read from our function on Cloudflare, cached for ten minutes, and the domain is looked up at hstspreload.org. Nothing is stored.
Grade
—
| Header | Value | Verdict |
|---|
HSTS preload list
—
How to add what is missing
Cloudflare Pages (_headers)
nginx
Apache (.htaccess)
Next step
Shall we fix it for you?
Send us this result and we reply within one business day with what we would fix first, how much work it is and what you can leave as it is.
Opens the form with the diagnosis already written. You can edit it before sending.
How to use it
01
Type the URL
The home page or any other: headers are usually the same across a site, but not always.
02
Read the grade and the reasons
Each header says whether it is there, whether its value works and what it protects. An A+ needs all seven set and no leaks.
03
Copy the configuration
The block for your server comes out with what is missing. Paste it, deploy and check again.
What each header protects, in one sentence
- HSTS
- Forces the browser to always use https, even when someone types http or an old link points there. (strict-transport-security)
- Content-Security-Policy
- States where scripts, styles and images may load from. It is the deep defence against injected code. (content-security-policy)
- X-Frame-Options
- Stops another site from showing yours inside an invisible frame to steal clicks (clickjacking). (x-frame-options)
- X-Content-Type-Options
- Prevents the browser from “guessing” a file type and running as a script something that was not one. (x-content-type-options)
- Referrer-Policy
- Controls how much of your page URL is sent to the sites you link to. Without it, the whole thing travels. (referrer-policy)
- Permissions-Policy
- Switches off camera, microphone, location and payments for the page and for whatever it embeds. (permissions-policy)
- Cross-Origin-Opener-Policy
- Isolates your window from the ones that opened it or that it opened, so they cannot manipulate it. (cross-origin-opener-policy)
- Server
- Does not protect: it tells which server you run. With a version, it saves work for anyone hunting known bugs. (server)
- X-Powered-By
- Does not protect: it names the language or framework. Same as Server, same remedy. (x-powered-by)
- X-XSS-Protection
- Obsolete: browsers ignore it or removed it. If present, it is inherited; it can go. (x-xss-protection)
Seven lines almost nobody sets
Security headers are the cheapest part of hardening a website: they change no code, touch no design and are set once. And still most sites send none, because nobody remembered on launch day.
The sites we ship leave with these headers in place, and the deployment checks them: if one disappears in a configuration change, the build says so before it reaches production. Same for the sites we maintain.
Frequently asked questions
Do security headers affect SEO?
Not directly: Google does not score them. But two of them touch things it does look at. HSTS consolidates the site on https, a ranking signal since 2014, and avoids http → https redirects on every visit. And a site hacked for lack of CSP ends up on the Safe Browsing list, which does sink traffic. It is cheap insurance.
Can Content-Security-Policy break my site?
Yes, if set blindly. A strict CSP blocks any script not on the list, analytics, chat and maps included. That is why the configuration proposed here only limits frames, forms and plugins: it breaks nothing and already closes clickjacking. The full CSP is written by reviewing every script on the site, and tested first in Report-Only mode.
What is the HSTS preload list and how do I join?
A list compiled into Chrome, Firefox, Safari and Edge with the domains that must only be visited over https, with no prior visit needed. To join, HSTS must carry a max-age of at least one year, includeSubDomains and preload; you request it at hstspreload.org and it takes weeks to reach browsers. Leaving is far slower, so be sure: every subdomain, internal ones included, will have to be served over https.
X-Frame-Options or frame-ancestors?
Both do the same thing: stop your page loading inside someone else’s frame. frame-ancestors, inside the CSP, is the modern one and allows lists of domains; X-Frame-Options is the old one and only understands DENY and SAMEORIGIN. Current browsers ignore X-Frame-Options when frame-ancestors is present. Setting both does no harm and covers old browsers.
What is nosniff for?
For compatibility, browsers try to guess a file type by looking at its content when the server does not state it properly. An attacker who manages to upload an “image” with JavaScript inside could exploit that. X-Content-Type-Options: nosniff switches the guessing off. It costs one line and has no side effects.
Does an A mean my site is secure?
No. It means the server sends the headers browsers understand, with values that do not cancel them. It is one layer: it protects against framing, downgrade to http and part of code injection. It knows nothing about your login form, your outdated dependencies or the admin password. Those are reviewed differently.
Is the URL I check stored?
No. Our function on Cloudflare makes the request, returns the headers to your browser and caches the result for ten minutes so it is not repeated if you check again. The domain is also looked up at hstspreload.org, the Google service that maintains the preload list. Neither receives anything else.
Background reading
Explained on the blog
Critical PHP and Node.js vulnerabilities: what happened and what to do
On October 21, PHP and Node.js shipped fixes for serious flaws that allow code to run on the server. What they mean in plain language, which versions fix them and what to do this week.
What is a vulnerability, and why does your website need maintenance?
What a software vulnerability is, why small websites are exposed too, what happens between the day a flaw is published and the day someone exploits it, and what keeping a site up to date actually involves.
HTTP security headers: which ones does your website need?
What HSTS, CSP, X-Frame-Options and the other security headers are, which attack each one stops, and in what order to switch them on without breaking anything.
Did your site get a D?
It is usually one well-spent afternoon: headers, https across the whole domain and a CSP that breaks nothing. If you also want someone to keep an eye on it, that is support.
We reply within one business dayBogotá · UTC−5