Tool · HTTP headers
The headers the browser actually gets
One GET. We read the response. No login, no JavaScript run on your side. If Cloudflare or nginx dropped a header, you see it.
Why we look here first
The site can “work” with zero security headers. Visitors will not notice. A missing HSTS or a missing frame restriction shows up later, usually after something dumb.
We also flag Permissions-Policy and COOP. Less famous than CSP; useful once you have an app, not only a WordPress page.
What we record
- Strict-Transport-Security
- Present? max-age at least 180 days? Otherwise the browser will not force HTTPS after the first visit.
- Content-Security-Policy
- Without CSP, an injected script has more room. We do not nitpick the policy; we say if it exists.
- X-Content-Type-Options
- nosniff, or the browser guesses the type.
- Clickjacking
- X-Frame-Options or CSP frame-ancestors. One of the two is enough.
- Referrer-Policy and Permissions-Policy
- Often missing. One leaks internal URLs; the other leaves camera / mic open.
What we skip
We do not open wp-admin. We do not lint CSP. A low score usually means a bare reverse proxy or a CMS as shipped.
http→https redirects are followed, a few hops. Internal URLs are refused.
In practice
I have an A+ elsewhere and a middling score here?
- Different grids. We are picky on HSTS (180 days) and we ignore decorative headers. Read the lines, not the number.
Do I need 100?
- No. CORP is optional. COOP depends on the product. HSTS + nosniff + a simple CSP is most of the work for a brochure site.
Does this hurt cache or SEO?
- No. One GET, like a browser. Your robots.txt is untouched.
Same shelf
Headers can look fine while the cert dies in eight days. Run the SSL check next.