Strict-Transport-Security (HSTS)
HSTS tells compatible browsers to use HTTPS when communicating with the website after the policy has been received.
Content-Security-Policy (CSP)
Content Security Policy can restrict which sources a browser may use for scripts, styles, images and other resources.
A carefully configured CSP can help reduce the impact of certain content-injection risks, but incorrect policies can also break legitimate website functionality.
X-Content-Type-Options
The commonly used value nosniff instructs browsers
not to reinterpret certain resource content types.
X-Frame-Options
X-Frame-Options can restrict whether a page may be displayed inside a frame on another page, helping reduce some forms of clickjacking exposure.
Referrer-Policy
Referrer-Policy controls how much referring URL information a browser sends when navigating between resources.
Permissions-Policy
Permissions-Policy can restrict access to selected browser capabilities such as camera, microphone and geolocation.
A missing header needs context and a remediation decision
Security configuration should not be reduced to a simple checklist. Whether a control is appropriate depends on the website, its functionality and the risk being addressed. A useful finding should explain the impact, priority, responsible role, remediation steps and how the change can be re-checked.
AssayMark reviews selected website security indicators and presents supported findings with practical context, remediation guidance and verification where the underlying check can legitimately re-test the control. A missing header is not presented as proof of compromise.
Explore website security assessment →