Why security headers?
With a few lines of web server configuration you tell the browser how strictly to treat your site: only load it over HTTPS, do not run foreign scripts, do not show it in foreign frames. It costs nothing and rules out whole classes of attacks.
The six most important headers
- Strict-Transport-Security (HSTS): the browser only loads the site over HTTPS, even if someone types http:// or clicks an old link.
- Content-Security-Policy (CSP): defines where scripts, styles and images may come from. The most effective protection against cross-site scripting, but also the most work. Test it as
Content-Security-Policy-Report-Onlyfirst. - X-Frame-Options / frame-ancestors: stops other sites from embedding yours invisibly and tricking users into clicks (clickjacking).
- X-Content-Type-Options: nosniff: the browser sticks to the declared file type instead of guessing.
- Referrer-Policy: how much of the current address is passed on to other sites.
- Permissions-Policy: which browser features such as camera, microphone or location may be used.
How is the grade calculated?
Each of the six headers earns a point if it is set and not obviously ineffective. Six points give an A, five a B and so on. A+ requires no open warnings and a CSP that really restricts scripts. Without HTTPS or with an invalid certificate the grade is F. The grade is a guide: a site without login or forms needs less than a customer portal.
Implementation notes
Set the headers where the response is created. If a reverse proxy or CDN sits in front, they often belong there. With nginx, add_header in a location block replaces all headers from the server block, and without always they are missing on error pages. With HSTS and includeSubDomains, every subdomain must support HTTPS.
Check the certificate itself in the SSL check and which CAs may issue in the CAA generator.
FAQ
Why does the tool show different headers than my browser?
Some servers send different responses depending on browser, language or login. The check is an anonymous request without cookies. Headers that are only set after login do not appear here.
Do I really need a Content Security Policy?
For a static site without forms the risk is low. As soon as users log in or enter data, a CSP is the best protection against injected JavaScript. Start with Report-Only and enforce it once no more violations are reported.
Isn’t X-XSS-Protection important?
No, not any more. All current browsers have removed the XSS filter, and in old versions it could even open vulnerabilities. Remove it or set it to 0.
Does the check put load on my site?
No. A single request is made (plus one per redirect and one for http://), and the content is cut off after the headers.
Can I check internal sites?
No, the hollop.net server only queries public addresses. For internal sites use the curl -sI command from the result in your own network.