Security headers checker

What this checks

We request the page the way a browser would (following up to five redirects) and read the response headers only. Pages aren't stored. The grade weighs the headers that stop real attacks:

• Content-Security-Policy: limits which scripts can run (XSS defence).
• Strict-Transport-Security: forces HTTPS so connections can't be downgraded.
• X-Content-Type-Options and frame-ancestors / X-Frame-Options: stop MIME sniffing and clickjacking.
• Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, cookie flags and version banners.

Setting headers in nginx

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
add_header Content-Security-Policy "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;