HTTP Security Headers & SSL Hardening Test
Audit your website for Content Security Policy (CSP), HSTS, and protection against clickjacking and data theft.
Overview & why this matters
HTTP security headers tell web browsers how to handle your website securely.
When these headers are missing, visitors and customers are exposed to malicious script injections (XSS), clickjacking inside hidden iframes, and insecure HTTP connection downgrade attacks.
Critical attack vectors mitigated by security headers
Defend Against XSS & Malware (CSP)
Content-Security-Policy stops hackers from executing injected JavaScript and stealing user sessions or credit cards.
Prevent Clickjacking (X-Frame-Options)
Ensures attackers cannot embed your login or checkout pages inside invisible frames to deceive visitors.
Enforce HTTPS Everywhere (HSTS)
Forces all browser connections to use encrypted HTTPS, preventing data interception on public Wi-Fi networks.
Recommended Nginx Configuration
Add these hardened response headers to your web server block:
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;