What Security Headers measures
The scanner requests your page and grades which security headers are present: Content Security Policy, Strict Transport Security, X-Frame-Options, X-Content-Type-Options, Referrer Policy and Permissions Policy.
How to read your result
An F simply means no headers are set, which is the default state of most hosting and is not evidence that you have been attacked. Getting to an A is mostly a configuration job. Content Security Policy is the hardest one to add because a policy that is too strict will break your own scripts, so it is normally added last and tested carefully.
What to change first
Add Strict-Transport-Security, X-Content-Type-Options and Referrer-Policy first. They take one line each, carry almost no risk of breaking anything, and lift the grade immediately.
Common questions
- Does an F grade mean my site has been hacked?
- No. It means optional protective headers are not set, which is the default for most hosts. It is a hardening opportunity rather than a breach.
- Will adding a Content Security Policy break my site?
- It can, if the policy blocks a script you rely on. Start in report only mode, watch what gets flagged, then enforce it once the list is clean.
- Do security headers help SEO?
- Not directly. They protect visitors, and some security scanners and enterprise buyers check them.
Related tests
Run this alongside every other test in Website Security Checks, or start from the full list of website testing tools.