What security headers a scan can see

A missing name on the response is a note for that URL and that date. It is not a certificate that the site is safe.

Security headers, in this scan, are four response headers on the HTML page. Content-Security-Policy. Strict-Transport-Security. X-Frame-Options. Referrer-Policy. If the name is absent, the report says so. The value is not graded. A header can be present and still be loose.

What the four security headers are

Security headers here means those four names, and only those four. The scan records a moderate finding when a name is missing on the HTML response. It does not parse whether script-src is tight, whether HSTS max-age is long, or whether Referrer-Policy is restrictive. Presence is the whole test.

The 2024 Web Almanac from HTTP Archive measured adoption on hosts. Content-Security-Policy showed up on 19% of them. That figure is a crawl from June 2024. It is not a target you fail by one point.

OWASP keeps the longer map on the HTTP Headers Cheat Sheet. This product keeps the short list.

A present header can still be loose

A present header only means the name was on the response for that URL. Strict-Transport-Security was on 34% of hosts in the HTTP Archive's 2024 crawl. Referrer-Policy was on 17%. Those rates do not say the values were strict. A loose value still counts as found.

This scan would still mark the header present if max-age is tiny, or if the referrer policy is permissive. The row means the name was sent.

Missing is not a breach report

X-Frame-Options appeared on 37% of hosts in that same 2024 crawl. Complience.app still wants that header name when a Content-Security-Policy uses frame-ancestors. The fix hint mentions frame-ancestors. The detector looks for X-Frame-Options. A framing directive in CSP is a different check.

Security headers are 10% of the score. The rest is accessibility, cookies, and the policy text. A missing header is not a penetration test. It will not tell you about an open admin path or a leaked key.

Read security headers next to the other slices

The same report holds axe-core findings and cookies set before Accept. The accessibility method is the website accessibility checker. What a machine can and cannot prove is in what an accessibility checker can and cannot prove. The notice is a separate read: what a privacy policy check can prove.

Run a public check if you want those four names on a homepage before you sign in.