What security headers can and cannot protect.
HTTP headers tell browsers how to treat content. They can reduce several browser-side risks, but they cannot repair insecure application code or guarantee a site has no vulnerabilities.
Strict Transport Security (HSTS)
HSTS tells compatible browsers to use HTTPS for a site after receiving the policy over a secure connection. Deploy it carefully: a long max-age can cause outages if related services are not ready for HTTPS. Our checklist looks for at least a 180-day duration.
Content Security Policy (CSP)
CSP restricts which scripts, styles, frames and other resources a browser may load. A policy that simply allows every origin may deliver little protection. Roll out a carefully tested policy using report-only mode before strict enforcement, particularly on ad-supported websites.
Clickjacking controls
Use CSP frame-ancestors to restrict who can embed a page. Older applications may use X-Frame-Options as a fallback. Choose policies compatible with legitimate embedding requirements.
X-Content-Type-Options
nosniff asks browsers to follow the declared MIME type rather than guessing. Pair it with accurate content types for scripts, stylesheets and other assets.
Referrer-Policy
A restrictive policy controls how much of the current page's URL is shared in requests to other sites. This helps reduce accidental leakage of sensitive path or query details.
Permissions-Policy
Permissions-Policy can limit unnecessary browser features such as microphone, camera and geolocation. Test the intended behaviour of your site's legitimate features.
What the score excludes
Headers alone do not reveal vulnerable plugins, server patch levels, insecure business logic, database exposure, weak passwords or data-protection compliance. Treat the report as a focused starting point and seek properly scoped professional assessments for higher-risk systems.
Check your own website
The free Sentinel checker needs domain verification and makes a read-only HTTPS request.
Open the checker →Further reading
For developing threats, vulnerabilities and policy changes, visit Privacy Needle News. For ongoing privacy governance, use Privacy Needle AI.