Security Headers Check

HTTP security headers are small response headers that tell the browser how to behave defensively. They are some of the highest-leverage fixes in web security: a few lines of configuration that neutralize entire classes of attack. VitalSite checks the six that matter most on your homepage and reports which are missing or weak.

The headers VitalSite checks

• Content-Security-Policy (CSP). The single most important header — it controls which scripts, styles, and resources may load, and is the strongest defense against cross-site scripting (XSS). Read our complete CSP guide.
• Strict-Transport-Security (HSTS). Forces browsers to use HTTPS for a set duration. We require a max-age of at least 31536000 (one year). See how to set up HSTS.
• X-Frame-Options. Set to SAMEORIGIN or DENY to stop other sites embedding yours in a hidden iframe — the basis of clickjacking.
• X-Content-Type-Options: nosniff. Stops the browser from MIME-sniffing responses into something dangerous.
• Referrer-Policy. Controls how much referrer data leaks to third-party sites.
• Permissions-Policy. Restricts powerful browser features like camera, microphone, and geolocation.

Why it matters

Missing headers are the most common finding across the sites VitalSite scans. They are invisible to visitors but wide open to attackers — and because they apply site-wide, fixing them protects every page at once. Many compliance checklists and security scorecards also grade these headers directly.

How to fix it

The exact syntax depends on your stack, and VitalSite tailors the fix guide to what it detects. A typical Nginx block looks like:

add_header Content-Security-Policy "default-src 'self'" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

On Apache use Header set directives; on Cloudflare use Transform Rules; on Vercel or Netlify add them to your config file or _headers. Read what security headers are and why they matter for the full breakdown.

A word on CSP: deploy it carefully. Start with Content-Security-Policy-Report-Only, watch for violations for about a week, add the legitimate sources you actually use, then switch to the enforcing header so you don't accidentally block your own scripts.

Verify the fix

Re-scan after deploying. Each header should flip to CLEAR, and your overall security score will climb noticeably — missing CSP and HSTS are high-severity findings worth several points each.

Run a free full-domain scan to see whether this affects your site — every page, with an exact fix guide. Pro and Agency plans add PDF export and monitoring.