Security headers differ between parts of the same site

Checks

• Login or checkout weaker than home page login_or_checkout_weaker_than_home_page
• Error pages without security headers error_pages_without_headers
• Static or API host without headers static_or_api_host_without_headers
• Headers differ between CDN and origin headers_differ_between_cdn_and_origin
• Subdomain weaker than main site subdomain_weaker_than_main_site

Findings

• A security header the home page sends is missing on login, checkout or error pages, or on another host
• The CDN and the origin server send different security headers
• A static or API host of the site answers without nosniff or HSTS

What this relies on

The strongest set found is the intended standard.

How to verify by hand

The server or CDN configuration.