Check any website's core security headers
HTTP security headers are one-line instructions a server sends with every response, telling the browser how to behave more safely. Three of them cost almost nothing to set and block whole classes of common attacks: X-Content-Type-Options, X-Frame-Options, and Referrer-Policy.
What a fail costs
On CheckWeb this is a weight-2 check on the Security axis, which is 35% of the overall score, and it fails outright when none of the three headers are present.
It is also the single most common failure across the sites checked on CheckWeb: more sites miss these headers than fail any other security check (see the statistics). Setting all three is usually a few lines of server config, so a fail here is cheap to clear and costly to leave.
How it looks in the report
In a CheckWeb report, under the Security axis, this shows as "Core security headers" with a red FAIL and the evidence "None present" when none of the three are set. A site with all three shows PASS, and the evidence names which are missing on a partial set.
Core security headers
None present
Exposed vs set
Exposed
None of the three set. A page can be framed inside an attacker's site for clickjacking, have its content-type second-guessed by the browser, or leak the full referring URL to third parties.
Set
All three present with safe values (nosniff, a frame policy, and a restrained Referrer-Policy).
How to fix it
- Nginx: add three `add_header` lines, `X-Content-Type-Options nosniff`, `X-Frame-Options SAMEORIGIN`, and `Referrer-Policy strict-origin-when-cross-origin`.
- Apache: the same three via `Header set`.
- App or framework: set them in middleware (a library like helmet does all three).
- CDN or edge: add the response headers at the edge if the origin cannot.
- Then verify: re-scan and watch the Security axis recover.
Check a site's security headers
Paste a URL to see which of the core headers a site sends and which are missing, with the exact values to add. Fix, re-scan, and confirm the check turns green.
Check my website