What are Security Headers?
Security headers are HTTP response headers that tell browsers how to behave when handling your site's content. They protect visitors from common attacks.
The Three We Check
#### 1. HSTS (Strict-Transport-Security)
Forces browsers to always use HTTPS, even if the user types http://.
Strict-Transport-Security: max-age=31536000; includeSubDomains
#### 2. Content-Security-Policy (CSP)
Controls which resources (scripts, images, styles) can be loaded. Prevents XSS attacks.
Content-Security-Policy: default-src 'self'; script-src 'self' cdn.example.com
#### 3. X-Frame-Options
Prevents your site from being embedded in an iframe (clickjacking protection).
X-Frame-Options: SAMEORIGIN
Scoring
| Score | Meaning |
|---|---|
| 3/3 | All key headers present — excellent |
| 2/3 | Missing one header — good but could improve |
| 1/3 | Minimal security — should be addressed |
| 0/3 | No security headers — vulnerable |