HTTP headers · HTTPS · browser controls
Web Security Guides
Review browser-facing security controls such as CSP, HSTS, clickjacking protection, referrer policy and related HTTP response behavior.
Scan a domain Explore Domain Security AssessmentWeb security
Find the remediation guide for your finding
Use the check name from a SecuTest report to open the matching operational guide.
Domain Security AssessmentAssess browser-facing web controls as part of a broader external domain security review. Run the related assessment →
Web securityClickjacking protectionWithout `frame-ancestors` or a valid X-Frame-Options value, another site may frame the application and trick users into interacting with hidden controls.Open remediation guide →Web securityContent Security PolicyA missing or permissive CSP does not create XSS by itself, but it removes a major defense that can limit script injection and data exfiltration.Open remediation guide →Web securityHTTP Strict Transport SecurityMissing, disabled, malformed, or short-lived HSTS leaves browsers able to make an insecure first or later HTTP request.Open remediation guide →Web securityHTTP to HTTPS redirectServing HTTP without a clear same-site HTTPS redirect leaves first visits exposed to interception, downgrade, and content injection.Open remediation guide →Web securityHTTPS availabilityWithout a retrievable HTTPS response, web traffic cannot rely on transport confidentiality, integrity, and authenticated server identity.Open remediation guide →Web securityPermissions PolicyWithout a Permissions-Policy, pages and embedded content may access browser features more broadly than the application requires.Open remediation guide →Web securityReferrer PolicyA missing or permissive Referrer-Policy can disclose internal paths, query values, or origin information to third-party destinations.Open remediation guide →Web securityServer software disclosureServer and framework identification headers provide reconnaissance data that can help attackers prioritize known exploits and tailor probes.Open remediation guide →Web securityX-Content-Type-OptionsWithout `X-Content-Type-Options: nosniff`, browsers may interpret a response as executable content despite an incorrect declared MIME type.Open remediation guide →