HeaderHound

Security headers report for Drupal

https://jamestarleton.com

Report generated: Sunday, 15 November 2026 - 19:35

Print this page or use your browser's Save as PDF to keep a copy.

View the live report

F 35%

Overall security score

34 out of 98 points

Failing. Most security headers are missing or misconfigured. Act on this now.

A+ and A: excellent B and C: needs work D and F: critical issues

Security header analysis

Status Header Current value Score Findings and recommendations
âš  Strict-Transport-Security HSTS
Tells browsers to only use HTTPS for all future requests. Prevents protocol downgrade attacks and cookie hijacking.
 max-age=2592000; includeSubDomains
8/15
  • âš  max-age is less than one year. Consider raising it to 31536000 (one year) or more.
  • âš  The preload directive is missing. Consider adding it and submitting the site to the HSTS preload list.
  • ✓ includeSubDomains is set.
✓ X-Frame-Options XFO
Protects against clickjacking by controlling whether the site can be embedded in iframes. Largely superseded by CSP frame-ancestors but still widely supported.
 DENY
8/8
  • ✓ DENY is the most restrictive setting. Pages can not be embedded anywhere.
✓ X-Content-Type-Options XCTO
Prevents browsers from MIME-sniffing a response away from the declared content type, reducing exposure to drive-by download attacks.
 nosniff
8/8
  • ✓ nosniff is set correctly.
✗ Content-Security-Policy CSP
The most powerful security header. It controls which resources the browser may load, which mitigates XSS, data injection and other code injection attacks.
 Not set
0/25
  • âš  CSP is not set. It is the most important security header: it controls which resources can be loaded and mitigates XSS attacks.
Recommended: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests
✓ Referrer-Policy RP
Controls how much referrer information is sent with requests. Restricting it protects user privacy and avoids leaking sensitive URLs.
 no-referrer-when-downgrade
8/8
  • ✓ The policy is a safe choice.
✗ Permissions-Policy PP
Controls access to browser features and APIs such as the camera, microphone and geolocation. Replaces the deprecated Feature-Policy header.
 Not set
0/8
  • âš  Permissions-Policy is missing. Scripts may use browser features like the camera, microphone and geolocation without restriction.
Recommended: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
✗ X-XSS-Protection XXP
Legacy header for the XSS filter in older browsers. Modern browsers ignore it and a strong CSP is preferred. A wrong value can introduce vulnerabilities.
 1
2/5
  • âš  "1" and "1; mode=block" can introduce vulnerabilities in some browsers. The recommended value is 0.
✗ Cross-Origin-Embedder-Policy COEP
Prevents a document from loading cross-origin resources that do not explicitly grant permission. Required for cross-origin isolation.
 Not set
0/7
  • âš  COEP is not set. It is required for cross-origin isolation, which enables features like SharedArrayBuffer.
Recommended: require-corp
✗ Cross-Origin-Opener-Policy COOP
Isolates the browsing context group, which protects against cross-origin attacks such as XS-Leaks and Spectre.
 Not set
0/7
  • âš  COOP is not set. The browsing context is not isolated, which leaves the site open to XS-Leaks and Spectre-style attacks.
Recommended: same-origin
✗ Cross-Origin-Resource-Policy CORP
Says whether other sites may include the resource, which protects against some cross-origin information leaks and side-channel attacks.
 Not set
0/7
  • âš  CORP is not set. Other sites may be able to include your resources, which can enable information leaks.
Recommended: same-origin

Information disclosure check

These headers may reveal details about the server software and technology stack.

Risk Header Value Advice
medium Server cloudflare Remove or mask the Server header so it does not disclose the web server software and version.
high X-Powered-By PHP/8.5.12 Remove the X-Powered-By header. It exposes your PHP version and other details of your stack.
medium X-Generator Drupal 11 (https://www.drupal.org) Remove the X-Generator header so it does not disclose your CMS and its version.
low X-Drupal-Cache HIT The X-Drupal-Cache header reveals that the site runs Drupal. Consider removing it in production.
low X-Drupal-Dynamic-Cache HIT The X-Drupal-Dynamic-Cache header reveals Drupal's caching internals. Consider removing it in production.
low Via 1.1 varnish The Via header reveals proxy server information. Consider masking it in production.