Security header missing

Why it matters

A few lines in the response tell the browser what is allowed: do not embed the site in a foreign page, do not guess file types, do not pass everything on to other sites. Without them a site is easier to misuse, for example for clickjacking.

How Snaglist checks it

This is part of the security check, a separate check next to the crawl, in Studio and Bureau, and only on a site you have verified. Snaglist only looks at what any visitor can see from outside. It never logs in, guesses no passwords and sends no attacks. It reads the response headers of the homepage and checks five of them: X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Content-Security-Policy and Permissions-Policy. Each missing one is listed.

Common causes

• The host or server does not set them by default
• No security plugin or server rule adds them
• A Content-Security-Policy was left out because it is harder to set up

How to fix it

1. Start with X-Content-Type-Options, X-Frame-Options and Referrer-Policy. They rarely break anything.
2. Set them in the server settings, in .htaccess or with a security plugin.
3. Test a Content-Security-Policy in report-only mode first.
4. Run the security check again to confirm.

How it shows in the report

In the report for your client this appears under the heading "Your site lacks a few standard protections". When everything is in order, the report says: "The standard security headers are in place".