Action list

Share this page with your team. The site owner can track work after verifying the domain on the monitoring page.

Based on the latest scan: Tue, 22 Sep 2026 12:06:20 GMT. Fixes are confirmed when a later scan no longer finds the issue.

medium · security · small effort
HSTS header is missing.
Work status
After confirming HTTPS works across the site, send Strict-Transport-Security with a suitable max-age.
Measured: Header absent · Target: Header present
medium · security · large effort
Content Security Policy is missing.
Work status
Begin with a report-only policy, inventory required origins, then enforce a restrictive policy.
Measured: Header absent · Target: Header present
low · security · small effort
X-Content-Type-Options header is missing.
Work status
Send X-Content-Type-Options: nosniff on responses.
Measured: Header absent · Target: nosniff

HSTS header is missing.