Strict-Transport-Security (HSTS)
HSTS tells compatible browsers to use HTTPS when communicating with the website after the policy has been received.
Content-Security-Policy (CSP)
Content Security Policy can restrict which sources a browser may use for scripts, styles, images and other resources.
A carefully configured CSP can help reduce the impact of certain content-injection risks, but incorrect policies can also break legitimate website functionality.
X-Content-Type-Options
The commonly used value nosniff instructs browsers
not to reinterpret certain resource content types.
X-Frame-Options
X-Frame-Options can restrict whether a page may be displayed inside a frame on another page, helping reduce some forms of clickjacking exposure.
Referrer-Policy
Referrer-Policy controls how much referring URL information a browser sends when navigating between resources.
Permissions-Policy
Permissions-Policy can restrict access to selected browser capabilities such as camera, microphone and geolocation.
A missing header needs context
Security configuration should not be reduced to a simple checklist. Whether a control is appropriate depends on the website, its functionality and the risk being addressed.
AssayMark reviews selected website security indicators and presents findings with practical context rather than treating every missing control as evidence of compromise.
Explore website security assessment →