Security finding
A security header the home page sends is missing on login, checkout or error pages, or on another host
Security Warning Severity: Medium
Part of the audit Security headers differ between parts of the same site. Finding id: security.headersAcrossSite.
What it costs you
A scanner that tests one address reports the home page and sees nothing wrong. The pages where visitors type passwords and card details, and the error pages a stranger can call up at will, are the ones left without the protection.
What to do
Send the same security headers on every response of every host, error responses included.
What it checks
- Login or checkout weaker than home page
- Error pages without security headers
- Subdomain weaker than main site
How to fix it
Fix
Send the same headers on every response
- Find where [reference url] gets [header]: web server, CDN or application.
- Find why [url] misses it: a separate application, a different server block, or an error handler that builds its own response.
- Move the header to a layer every response passes through.
How to check: curl -sI [url] | grep -i [header]
How to verify by hand
The server or CDN configuration.
What this relies on
The strongest set found is the intended standard.