Is my website missing security headers?

Updated 2026-10-17

Short answer: security headers are instructions your site sends with every page, telling browsers to insist on HTTPS, block clickjacking, stop guessing file types and limit where scripts can load from. They cost nothing to add, and missing ones are a common finding in security reviews.

How to check it yourself

  1. Open your site, then developer tools, then Network, then the first request, then Response Headers.
  2. Look for strict-transport-security, content-security-policy, x-content-type-options, referrer-policy and x-frame-options.
  3. Add the missing ones in your host, CDN or server config.
  4. Add a Content Security Policy last and carefully: too strict a policy breaks scripts.

Why it matters

Security headers are instructions your site sends to browsers, such as "only load this site over HTTPS" or "don't let other sites put this page in a frame". They don't fix bugs, but they block whole classes of common attacks. They cost nothing to add, and they're often missing simply because nobody turned them on.

Common causes

  • The host or server sends no security headers by default.
  • Headers were set on one server or CDN and lost in a migration.
  • A plugin that added them was removed.
  • A strict header broke something once, so all of them were removed.

What Preventionlabs shows

Every report lists the security headers your homepage sends and the ones it's missing, rates how strict your Content Security Policy is, and checks how long browsers are told to insist on HTTPS. For example, from a real report: "Security headers set: strict-transport-security, content-security-policy, x-content-type-options, referrer-policy, x-frame-options."

Price

First report free, no card needed. Then A$50 a month, up to 10 domains.

Run your first report free

More questions it answers