Does a missing header mean my site is vulnerable?
Security headers tell browsers how to handle transport, scripts, embedding and content types. Presence alone is not enough: the policy must fit the application and be deployed without breaking legitimate flows.
What the engine observes
- Strict-Transport-Security max-age
- Content-Security-Policy and script restrictions
- Frame embedding, nosniff, Referrer-Policy and Permissions-Policy
A missing header is not automatically an exploitable vulnerability. CSP effectiveness and application compatibility need contextual review.
What happens after a check?
Read the observations and their evidence first. Save the private report if useful. To go deeper, verify domain control and agree a precise scope, testing window and resource limits. High-impact candidates remain candidates until appropriate validation is complete.
Read verification policy ↗Related checks
Website security checker ↗SSL & TLS checker ↗Content Security Policy checker ↗Cookie security checker ↗CORS signals checker ↗Website vulnerability assessment ↗