What this check inspects
Shipwork fetches the response headers and checks for Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, X-Frame-Options or a frame-ancestors directive, and Permissions-Policy. It flags an http page as an error, and notes when Server or X-Powered-By reveal the software version.
What a failure means
Missing HSTS and X-Content-Type-Options are warnings because they remove a protection browsers would otherwise apply. An http page is an error. A version-revealing Server or X-Powered-By header is informational, useful mainly because it narrows what an attacker knows.
How to fix it
- Set Strict-Transport-Security with a long max-age, and add includeSubDomains once you are sure every subdomain supports https.
- Add X-Content-Type-Options: nosniff so browsers do not guess content types.
- Introduce a Content-Security-Policy, starting in report-only mode so you can see what would break.
- Suppress version information in the Server and X-Powered-By headers.
A typical failure, worked through
The setupA site sits behind a CDN that adds HSTS at the edge, but a direct request to the origin bypasses the CDN and returns no HSTS header.
What the check reportsThe check, which requests the public host, sees the CDN header and passes. The related transport check reports whether preload and includeSubDomains are present, which is where the real gap usually is.
The pointCheck the header on the host crawlers and browsers actually use. A protection that exists only on one path is a partial protection.