Security finding
HTML pages are sent without a security header
Security Warning Severity: Medium
Part of the audit Security headers. Finding id: security.headersMissing.
What it costs you
Without [header], [risk].
What to do
Send [add name]: [add value] on every HTML response, error pages included.
What it checks
- Content security policy missing or unsafe
- No protection against being embedded in other sites
- File type sniffing not switched off
- No rule on sharing the previous page address
- No limits on browser features
- No cross-site isolation settings
- Security settings differ between page types