What Security Headers measures
The scanner requests your page and grades which security headers are present: Content Security Policy, Strict Transport Security, X-Frame-Options, X-Content-Type-Options, Referrer Policy and Permissions Policy.
How to read your result
An F simply means no headers are set, which is the default state of most hosting and is not evidence that you have been attacked. Getting to an A is mostly a configuration job. Content Security Policy is the hardest one to add because a policy that is too strict will break your own scripts, so it is normally added last and tested carefully.
What to change first
Add Strict-Transport-Security, X-Content-Type-Options and Referrer-Policy first. They take one line each, carry almost no risk of breaking anything, and lift the grade immediately.
Common questions
- Does an F grade mean my site has been hacked?
- No. It means optional protective headers are not set, which is the default for most hosts. It is a hardening opportunity rather than a breach.
- Will adding a Content Security Policy break my site?
- It can, if the policy blocks a script you rely on. Start in report only mode, watch what gets flagged, then enforce it once the list is clean.
- Do security headers help SEO?
- Not directly. They protect visitors, and some security scanners and enterprise buyers check them.
