Headers to review
Common headers include Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and cookie flags. The right setup depends on your application.
How to interpret results
A missing header is a prompt to review, not proof of a vulnerability. A present header can still be weak if the value is too broad or does not match how the site works.
Common mistakes
Do not copy strict policies into production without testing. Some values can break scripts, images, embeds, or login flows.
FAQ
Do headers certify security?
No. They are useful defensive signals, not certification.
Should I test after deployment?
Yes. Check the final public URL after redirects and CDN rules are applied.