ShipworkSite inspection
Checks
Every error, explainedGuides →
Pricing Learn Guides

Are you sending the headers a secure site should?

Security headers are set once at the server or CDN and forgotten. When they are missing, nothing visible breaks, but browsers are left without instructions that protect visitors from downgrade, sniffing and framing attacks.

Runs the free audit, which includes this check where it applies to your site. Nothing is stored.

What this check inspects

Shipwork fetches the response headers and checks for Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, X-Frame-Options or a frame-ancestors directive, and Permissions-Policy. It flags an http page as an error, and notes when Server or X-Powered-By reveal the software version.

What a failure means

Missing HSTS and X-Content-Type-Options are warnings because they remove a protection browsers would otherwise apply. An http page is an error. A version-revealing Server or X-Powered-By header is informational, useful mainly because it narrows what an attacker knows.

How to fix it

  1. Set Strict-Transport-Security with a long max-age, and add includeSubDomains once you are sure every subdomain supports https.
  2. Add X-Content-Type-Options: nosniff so browsers do not guess content types.
  3. Introduce a Content-Security-Policy, starting in report-only mode so you can see what would break.
  4. Suppress version information in the Server and X-Powered-By headers.

A typical failure, worked through

The setupA site sits behind a CDN that adds HSTS at the edge, but a direct request to the origin bypasses the CDN and returns no HSTS header.

What the check reportsThe check, which requests the public host, sees the CDN header and passes. The related transport check reports whether preload and includeSubDomains are present, which is where the real gap usually is.

The pointCheck the header on the host crawlers and browsers actually use. A protection that exists only on one path is a partial protection.

Questions

Do security headers affect SEO?
Not directly, but sites without them are more exposed, and an http page or a broken certificate does affect how crawlers and visitors reach the site.
Is HSTS risky to enable?
It can be if a subdomain only supports http, which is why includeSubDomains and preload are separate decisions. Start without preload and add it once every subdomain is ready.
What is X-Content-Type-Options for?
It stops browsers sniffing a file content type and treating, for example, an uploaded text file as a script. It is a small header that closes a real class of attack.

Related checks and guides