Which headers does this check look at?

Three: X-Content-Type-Options, X-Frame-Options, and Referrer-Policy. They are grouped because they share a fix (one line of server config each) and because none of them can break a normal page at safe values. HSTS and Content-Security-Policy are checked separately, since both need a rollout plan rather than a single line.

Is a partial set enough to pass?

No. The check passes when all three are present, and the evidence names the ones still missing on a partial set. Each header blocks a different class of attack, so two out of three leaves the third class open.

Will X-Frame-Options break embedded widgets or iframes?

It can, and that is the one value worth choosing deliberately. SAMEORIGIN allows a site to frame its own pages and blocks everyone else, which suits almost every site. A page that is meant to be embedded elsewhere, such as a booking widget, needs a frame-ancestors rule in Content-Security-Policy naming the allowed hosts instead.

Do security headers slow a site down?

No measurably. They add a few dozen bytes to each response and require no extra work from the browser. This is why a fail here is worth clearing first: the cost is close to zero and the exposure it removes is real.

← All security check guides

Check any website's core security headers

HTTP security headers are one-line instructions a server sends with every response, telling the browser how to behave more safely. Three of them cost almost nothing to set and block whole classes of common attacks: X-Content-Type-Options, X-Frame-Options, and Referrer-Policy.

What a fail costs

On CheckWeb this is a weight-2 check on the Security axis, which is 35% of the overall score, and it fails outright when none of the three headers are present.

It is also the single most common failure across the sites checked on CheckWeb: more sites miss these headers than fail any other security check (see the statistics). Setting all three is usually a few lines of server config, so a fail here is cheap to clear and costly to leave.

How it looks in the report

In a CheckWeb report, under the Security axis, this shows as "Core security headers" with a red FAIL and the evidence "None present" when none of the three are set. A site with all three shows PASS, and the evidence names which are missing on a partial set.

Example

Core security headers

None present

FAIL

Exposed vs set

Exposed

None of the three set. A page can be framed inside an attacker's site for clickjacking, have its content-type second-guessed by the browser, or leak the full referring URL to third parties.

Set

All three present with safe values (nosniff, a frame policy, and a restrained Referrer-Policy).

How to fix it

Nginx: add three `add_header` lines, `X-Content-Type-Options nosniff`, `X-Frame-Options SAMEORIGIN`, and `Referrer-Policy strict-origin-when-cross-origin`.
Apache: the same three via `Header set`.
App or framework: set them in middleware (a library like helmet does all three).
CDN or edge: add the response headers at the edge if the origin cannot.
Then verify: re-scan and watch the Security axis recover.

Check a site's security headers

Paste a URL to see which of the core headers a site sends and which are missing, with the exact values to add. Fix, re-scan, and confirm the check turns green.

Check my website

FAQ

Which headers does this check look at?: Three: X-Content-Type-Options, X-Frame-Options, and Referrer-Policy. They are grouped because they share a fix (one line of server config each) and because none of them can break a normal page at safe values. HSTS and Content-Security-Policy are checked separately, since both need a rollout plan rather than a single line.
Is a partial set enough to pass?: No. The check passes when all three are present, and the evidence names the ones still missing on a partial set. Each header blocks a different class of attack, so two out of three leaves the third class open.
Will X-Frame-Options break embedded widgets or iframes?: It can, and that is the one value worth choosing deliberately. SAMEORIGIN allows a site to frame its own pages and blocks everyone else, which suits almost every site. A page that is meant to be embedded elsewhere, such as a booking widget, needs a frame-ancestors rule in Content-Security-Policy naming the allowed hosts instead.
Do security headers slow a site down?: No measurably. They add a few dozen bytes to each response and require no extra work from the browser. This is why a fail here is worth clearing first: the cost is close to zero and the exposure it removes is real.

Related checks

Browse recent public reports →