How it works
Once a day, we request your page and check the HTTP headers that tell browsers to protect your visitors:
| Header | What it protects against |
|---|---|
Strict-Transport-Security (HSTS) |
Downgrades to unencrypted HTTP. It should last at least a year (max-age=31536000). |
Content-Security-Policy |
Cross-site scripting: it tells the browser which sources may load scripts, styles and frames. |
X-Frame-Options, or frame-ancestors in the CSP |
Clickjacking: other sites showing your page in an invisible frame. |
X-Content-Type-Options: nosniff |
Browsers guessing a file's type and running it as a script. |
Referrer-Policy |
Leaking full URLs, including tokens in them, to other sites. |
We also check that the plain http:// address redirects to HTTPS. If your HSTS header asks for preloading, we check that the domain is actually submitted to the HSTS preload list.
Statuses
| Status | Meaning |
|---|---|
| OK | All recommended headers are set. |
| Warning | A header is missing, HSTS lasts less than a year, preloading is requested but not submitted, or we could not connect. |
| Failed | The HTTP version of the site does not redirect to HTTPS. |
By default you are notified of failures only.
Fixing common problems
Add the headers in your web server, CDN or application. In nginx:
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Content-Security-Policy "default-src 'self'" always;
Start a new Content-Security-Policy with the Content-Security-Policy-Report-Only header, so violations are reported without breaking the page, then tighten the policy before you enforce it.