Request headers
Every request carries headers: the browser and system (User-Agent and Sec-CH-UA client hints), accepted languages and formats, privacy signals (Sec-GPC) and how the request was made (Sec-Fetch). Cookies and authorisation headers are never shown here.
Security headers
The checker follows up to five redirects, connects only to public addresses on ports 80 and 443, and reads headers only, never page content.
- Strict-Transport-Security: use HTTPS only, for a set time.
- Content-Security-Policy: where scripts and other resources may load from; the main defence against cross-site scripting.
- X-Content-Type-Options: nosniff stops browsers guessing file types.
- X-Frame-Options or frame-ancestors: who may show the page in a frame (clickjacking).
- Referrer-Policy and Permissions-Policy: what is shared with other sites and which browser features are allowed.
Questions
- Why is a header marked as a warning but the site works?
- Security headers protect against attacks; a site works without them. A warning means one layer of protection is missing or weak.