Security and Trust

Important security headers are missing

Prioritize missing browser security headers without breaking scripts, analytics, checkout, or application routes.

Run Security Headers Grade Browse workflows

Workflow shape

1Confirm the symptom

2Collect live evidence

3Fix in the right order

4Retest the same URL

What this means

Missing headers do not always mean an immediate exploit, but they reduce browser guardrails. The right rollout depends on HTTPS stability, third-party scripts, and application behavior.

Use this when

A scanner reports missing CSP, HSTS, X-Frame-Options, or related headers.
You want to improve browser-facing security without breaking production flows.
You need evidence for launch QA, client handoff, or a security review.

Evidence

What to collect before changing anything

Current response headers on homepage, login, checkout, app, and content pages.
All script, style, image, font, frame, and connect sources used by the site.
HTTPS coverage and mixed content status before enabling strict policies.
Console errors or CSP reports from a report-only test.

Diagnosis

Run the checks in this order

1Run Security Headers Grade on representative public routes.
2Run Headers Checker to inspect exact values from the live response.
3Use CSP Generator to create a starting policy from real asset needs.
4Run Mixed Content Scanner before enforcing HSTS or upgrade-insecure-requests.
5Test report-only CSP before moving to enforcement.

Fix plan

What to fix first

1Fix HTTPS and mixed content issues before strict transport policies.
2Add safer baseline headers such as X-Content-Type-Options and Referrer-Policy.
3Roll out CSP in report-only mode and review violations.
4Enable HSTS only after apex, www, and subdomains are HTTPS-ready.
5Promote policies gradually and retest key user flows.

Retest

How to confirm the fix worked

Re-run security headers, headers, SSL, and mixed content checks.
Confirm no checkout, login, analytics, or embedded flows break.
Keep a rollback plan for strict CSP and HSTS changes.

FAQ

Common questions

Is a perfect security header score required?+

No. The goal is appropriate risk reduction. Some sites need different policies based on embeds, apps, and third-party dependencies.

Can CSP break a website?+

Yes. That is why report-only testing and asset inventory should come before enforcement.

Loading CheckWebs…