Skip to content
Uzman Tescil
TR

Security Headers

Score HSTS, CSP and other security HTTP headers and spot missing protections.

Example: www.uzmantescil.com.tr

Güvenlik skoru

https://www.google.com/

HTTP 200

20
  • HSTS Recommended Eksik
  • CSP Recommended Eksik
  • X-Frame-Options Recommended SAMEORIGIN
  • X-Content-Type-Options Recommended Eksik
  • Referrer-Policy Recommended Eksik
  • Permissions-Policy Eksik
  • COOP Eksik
  • CORP Eksik
  • X-XSS-Protection 0
  • Server gws
All tools Look Up

What security headers are

They are HTTP response fields that tell the browser how to open the site. HSTS keeps the address on HTTPS, CSP limits which sources may load, X-Frame-Options stops other sites from framing the page, X-Content-Type-Options turns off MIME sniffing, and Referrer-Policy limits which URL leaks outward. Each header is a row and a bar.

Header What it protects A practical value
Strict-Transport-Security Falling back to HTTP max-age of at least a few months
Content-Security-Policy Unwanted scripts and frames Try Report-Only first
X-Frame-Options Clickjacking SAMEORIGIN
X-Content-Type-Options MIME sniffing nosniff
Referrer-Policy URL leakage strict-origin-when-cross-origin
Permissions-Policy Camera, microphone, location Disable APIs you do not use

Do not enable all of them in one day

A wrong CSP will also block your own scripts and checkout. Start with low-risk headers such as nosniff and SAMEORIGIN. Do not publish HSTS with includeSubDomains and preload until every subdomain is on HTTPS. Leaving the preload list takes months.

Frequently asked questions

Why do security headers matter?

They instruct the browser about HTTPS, framing and file types. Gaps show up as a score and bars.

Are all of them required?

HSTS, X-Frame-Options, X-Content-Type-Options and Referrer-Policy are a solid start. CSP needs its own design.

How do I add CSP?

Set Content-Security-Policy on the server or CDN. Use Content-Security-Policy-Report-Only first so you can see what would break.

Does a low score mean the site was hacked?

No. A missing header is a hardening gap. This tool does not scan for malware.

Where do I set them?

In Apache, Nginx, LiteSpeed or Cloudflare response rules. A meta tag is not valid for HSTS.

Other website tools

WhatsApp Message us now Call Now 0850 309 1 889