Skip to content
whois.me.uk
Menu
Sign in

SEC-HEADERS-GRADE

Security headers below good practice

What it means

Headers such as HSTS, Content-Security-Policy, X-Content-Type-Options and X-Frame-Options tell browsers to refuse whole classes of attack. Each missing one is a defence you do not have.

How to fix it

  1. 1Add Strict-Transport-Security: max-age=31536000; includeSubDomains.
  2. 2Add X-Content-Type-Options: nosniff and X-Frame-Options: DENY (or a frame-ancestors CSP directive).
  3. 3Add a Referrer-Policy and a Permissions-Policy.
  4. 4Introduce Content-Security-Policy in report-only mode first, then enforce.
  5. 5Set them once at the web server or CDN for every response.

Re-check after the change

DNS changes can take up to the record's TTL to be seen; use Re-run on the result page to bypass our 10-minute cache.