Security headers: which ones you must set
A browser trusts a site not because a lock sits in it, but because the response says what is allowed: which versions, which scripts, which cookies, how long a name may be remembered. Your site says that itself — in the headers. A header that is missing is not style, it is silence, and silence the browser fills in by its own rules.
This article walks the headers that matter, what they do and what may be expected of them. Afterward it is one question: does my site set them, and where in the chain? That question the HTTP headers tool measures — hop by hop, including what a CDN or proxy adds on its own.
HSTS: the name a browser may no longer forget
`Strict-Transport-Security` tells a browser: from now on visit this name only via HTTPS. Without `includeSubDomains` it holds for the name itself only — subdomains remain separately visitable — and without preload notation it is a request, not a rule. HSTS is the first header that closes the address layer: without it, one typo or one HTTP offer suffices to end up outside the secure chain.
CSP: what the page may execute
Content-Security-Policy limits which scripts, styles and images a page may load — the brake on third-party material and injected code. A CSP is hard to set well without knowing your own page; start where you are and widen. The header is measurable (it stands or does not, and what stands is text); whether it is smart enough for your page, no scanner in the world judges — so our website scan does not claim that either.
Referrer-Policy, X-Content-Type-Options, cookies
Referrer-Policy determines what a site passes on to a next site about where it came from. `X-Content-Type-Options: nosniff` forbids a browser from guessing file kinds. And cookies with `Secure`, `HttpOnly` and `SameSite` are not headers of the origin itself but measured material in the same response. The HTTP headers tool shows them, with the shortfall list that names only measured absences.
Where in the chain do you set it?
Standing behind a CDN, load balancer or hosting layer, you sometimes see headers appear that you never wrote — or disappear that you did write. Measuring at the public address is therefore the other measurement: the redirect chain in the headers tool reveals where the response changes. Set your policy at the origin and check at the address what rolled out; TLS: what is still open is the sister-question at the connection side.