Security settings your site sends to browsers
A handful of short instructions your site can send with every page, telling browsers how to protect your visitors.
Every time a browser loads your page, your site sends some instructions along with it. They're invisible to visitors, but browsers follow them. A few of them make attacks much harder.
The settings that matter
- Content Security Policy lists where scripts are allowed to come from. If an attacker manages to slip a script onto your page, the browser refuses to run it.
- Frame protection stops other sites from showing your pages inside theirs, a trick used to make people click buttons they can't see.
- Content type protection stops the browser from guessing what a file is, which could turn an uploaded image into a script.
- Referrer policy controls how much of your page address is shared with other sites when someone clicks a link.
- Cookie flags keep sign-in cookies out of reach of scripts and away from unencrypted connections.
Why they're often missing
None of these are on by default. Frameworks and hosts leave them to you, and a site works fine without them, so nobody notices until something goes wrong.
Most can be added in one place, the configuration file of your host or framework. Content Security Policy takes more care, because a strict one can block scripts your site needs, so it's usually added in steps.
A scan reads the settings your site actually sends and says which are missing or too loose.
Was this helpful?
What the lock in the address bar really means
The padlock icon means the connection is private, not that the site is trustworthy, and a few settings keep it that way.
A secret key in your website's code
Why a password or key that ends up in your site's public code can be read by anyone, and what to do when it happens.