Check HTTP headers

Why security headers matter

HTTP response headers control how the browser handles a page. Some of them are security instructions: they enforce HTTPS, forbid embedding in foreign pages, limit which scripts may run and prevent the browser from guessing file types. Without them the page is more vulnerable than it needs to be, even if the application itself is flawless.

The headers in detail

• Strict-Transport-Security (HSTS): the browser will only connect over HTTPS from now on. Recommended: max-age=63072000; includeSubDomains; preload.
• Content-Security-Policy (CSP): defines which sources scripts, styles and images may be loaded from. The most effective protection against cross-site scripting, but also the most laborious.
• X-Content-Type-Options: nosniff stops the browser from guessing the content type.
• X-Frame-Options or frame-ancestors in the CSP: prevents clickjacking through embedding in foreign pages.
• Referrer-Policy: limits which parts of the URL are passed on to other sites. Recommended: strict-origin-when-cross-origin.
• Permissions-Policy: disables browser features such as camera, microphone or geolocation the page does not need.

Information that should not leak

Headers such as Server: nginx/1.18.0 or X-Powered-By: PHP/8.1.2 reveal versions that attackers match against known vulnerabilities. They are not a security problem in themselves, but an unnecessary gift. In nginx: server_tokens off; in PHP: expose_php = Off.

HTTP/2 and HTTP/3

Besides the headers the checker shows the negotiated HTTP version. The request offers HTTP/2 to the server; if it only answers with HTTP/1.1, HTTP/2 is not enabled. That is not a security flaw, but a wasted optimisation: HTTP/2 loads all resources of a page over a single connection. In nginx, listen 443 ssl http2; is enough, in Apache Protocols h2 http/1.1.

HTTP/3 runs over QUIC (UDP 443) and is announced in the Alt-Svc header (h3=":443"). "HTTP/3 advertised" means the header is set; "HTTP/3 available" means a second request restricted to HTTP/3 actually got an answer. If it stays at "advertised", a firewall often blocks UDP port 443 or the checking location could not test HTTP/3.

Example for nginx

A solid starting point for a typical website:

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

Frequently asked questions

Will a CSP break my website?

A CSP that is too strict blocks scripts and styles. Test with Content-Security-Policy-Report-Only first, collect violations and then enforce the policy.

Is HSTS with a short max-age enough?

For the rollout, yes. For the browsers' preload list you need at least one year and includeSubDomains.

Are the headers set by Cloudflare?

Cloudflare can add them, but it does not replace the configuration at the origin. The checker shows what actually reaches the visitor.