Security finding
A static or API host of the site answers without nosniff or HSTS
Security Warning Severity: Low
Part of the audit Security headers differ between parts of the same site. Finding id: security.staticHostWithoutHeaders.
What it costs you
The pages are protected and the host that serves their scripts or data is not.
What to do
Send [add name]: [add value] on every response of [host].
What it checks
- Static or API host without headers
How to fix it
Fix
How to verify by hand
The server or CDN configuration.
What this relies on
The strongest set found is the intended standard.