Skip to content
CyberVigil
Tools
Website security scanDMARC checkerSPF checkerSSL checkerSecurity headers checker
Guides
Website securityEmail securitySmall business basicsBy industryCompliance & insuranceFix guides
How it worksPricingGet started free
Back to report
Partially configured

Security headers could be stronger

3 of 6 recommended security headers are in place. Adding the rest helps protect your website from common attacks.

What are security headers?

Security headers are short instructions your website sends to browsers along with each page. They tell the browser to always use HTTPS, refuse to load your site inside other sites, and limit risky behaviors.Visitors never see them, but they close off whole categories of common attacks.

What we found

3 of 6 headers in place
Missing or weak: Strict-Transport-Security (HSTS), Referrer-Policy, Permissions-Policy.

Recommended fix

Add the missing security headers

These are server settings. Where you add them depends on how your website is hosted.

Typical time: 15–30 minutes

Step-by-step instructions

  1. 1
    Choose where your site is hosted
    Pick the tab that matches your setup below.
  2. 2
    Add the recommended headers
    Copy the values shown. They're safe defaults for most small business websites.
  3. 3
    Check your site still works
    Click around your site, especially forms, embedded videos and checkout.
  4. 4
    Re-check your website
    Come back and re-check to confirm the headers are live.

Instructions for WordPress

  1. 1Ask your hosting company whether they can add security headers for you. Many managed WordPress hosts do this in their control panel.
  2. 2If not, install a reputable headers plugin (search the plugin directory for "security headers") and enable the headers below.
  3. 3If your host uses Apache and you're comfortable editing files, you can add the .htaccess lines in the Apache tab instead.
  4. 4Re-check your website and confirm nothing on your site broke.
Headers to enable
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()
Content-Security-Policy: frame-ancestors 'self'; upgrade-insecure-requests
Take the first step

See your own results

Run the same free check on your website. It takes about 15 seconds.

  • Free check
  • No signup
  • No changes to your website