Home / Blog / Website Security / How do I check if my website is secure, and what should I do if security headers are missing?

Answers

How do I check if my website is secure, and what should I do if security headers are missing?

15 October 2026 · By John Carlsson

Scan your domain with Mozilla HTTP Observatory, which grades your HTTP security headers, and check the Security issues report in Google Search Console for hacking or malware. If headers are missing, add them at your server, host or CDN, starting with the low-risk ones, and test a Content Security Policy in report-only mode before enforcing it.

Step 1: scan your headers with Mozilla HTTP Observatory

Mozilla's HTTP Observatory is a free tool that assesses a site's HTTP headers and other key security configurations, including CSP and HSTS, and gives a grade, a score and recommendations. Its FAQ says it also checks whether your server redirects from HTTP to HTTPS on the same hostname before any other redirect.

Know its limits. The FAQ says it does not test for outdated software, SQL injection, vulnerable CMS plugins or password storage, and that a good grade does not mean a site is secure. Scan history for each domain is public, and you can only rescan once every 60 seconds.

Step 2: check Search Console for security issues

If your site is verified in Google Search Console, open the Security issues report. It lists problems Google has found in three groups: hacked content, malware and unwanted software, and social engineering. If something is listed, Google's help page says to fix every issue on every affected page, test your fixes, then select Request Review and explain the issue, what you did and the outcome. Reviews can take days or weeks.

What each security header does

Strict-Transport-Security (HSTS) tells browsers to only use HTTPS for your host and to upgrade future HTTP requests. MDN gives Strict-Transport-Security: max-age=31536000; includeSubDomains as an example. It must be sent over HTTPS, as browsers ignore it over HTTP. Only add includeSubDomains if every subdomain works over HTTPS.
Content-Security-Policy controls which sources the page may load scripts, styles, images and other resources from. MDN says it is mainly used as a defence against cross-site scripting.
X-Content-Type-Options with the value nosniff tells browsers to respect the declared content type instead of guessing it.
Referrer-Policy controls how much referrer information is sent with requests. MDN lists strict-origin-when-cross-origin as the default when none is set.
Permissions-Policy declares which browser features your page and embedded content may use, for example Permissions-Policy: geolocation=(), camera=() to turn off location and camera.
X-Frame-Options and the CSP frame-ancestors directive control whether other sites can embed your pages in a frame, which is the defence against clickjacking. MDN describes frame-ancestors as a replacement for X-Frame-Options, and suggests setting both so older browsers are covered.

What to do if headers are missing

OWASP's Top 10:2025 lists not sending security headers as part of A02 Security Misconfiguration, so missing headers are worth fixing. Work through them in this order:

Add X-Content-Type-Options, Referrer-Policy and Permissions-Policy first. Each one is a single header with a simple value.
Add HSTS once every page loads over HTTPS. Start with a short max-age, check nothing breaks, then raise it.
Add frame-ancestors, for example Content-Security-Policy: frame-ancestors 'self', unless other sites need to embed your pages. MDN notes this directive does not work in a meta tag, so it must be a header.
Build a full Content-Security-Policy last, testing it first with the Content-Security-Policy-Report-Only header so nothing is blocked while you check reports.
Rescan with HTTP Observatory after each change.

Headers are set where your site is served: your web server configuration, your hosting control panel or your CDN. If you cannot reach those settings, ask your host to add them.

Our Security Audit offers a free and a paid security check. Its scoring was built to mirror Mozilla HTTP Observatory, then extended with DNS, SPF, DKIM, DMARC and known CVE checks.

Sources

Frequently asked questions

Does an A+ on HTTP Observatory mean my site is secure?

No. The Observatory FAQ says it focuses on HTTP headers and related settings and does not test for outdated software, SQL injection, vulnerable CMS plugins or how passwords are stored. A strong grade means your headers are well configured. You still need to keep software updated, check Search Console for security issues and fix any vulnerabilities in the site itself.

Can I add security headers with a meta tag?

Only partly. MDN says a Content Security Policy can be delivered in a meta element, but that option does not support all CSP features. The frame-ancestors directive and the Content-Security-Policy-Report-Only header do not work in a meta element, and headers such as Strict-Transport-Security are HTTP response headers. Set them in your server, hosting or CDN configuration instead.