HeaderHound

Security headers report for Drupal

https://github.com

Report generated: Sunday, 15 November 2026 - 18:45

Print this page or use your browser's Save as PDF to keep a copy.

View the live report

C 66%

Overall security score

65 out of 98 points

Below average. Important security headers are missing or misconfigured.

A+ and A: excellent B and C: needs work D and F: critical issues

Security header analysis

Status Header Current value Score Findings and recommendations
✓ Strict-Transport-Security HSTS
Tells browsers to only use HTTPS for all future requests. Prevents protocol downgrade attacks and cookie hijacking.
 max-age=31536000; includeSubdomains; preload
15/15
  • ✓ max-age is at least one year, as recommended.
  • ✓ includeSubDomains is set.
  • ✓ preload is set, so the site is eligible for the HSTS preload list.
✓ X-Frame-Options XFO
Protects against clickjacking by controlling whether the site can be embedded in iframes. Largely superseded by CSP frame-ancestors but still widely supported.
 deny
8/8
  • ✓ DENY is the most restrictive setting. Pages can not be embedded anywhere.
✓ X-Content-Type-Options XCTO
Prevents browsers from MIME-sniffing a response away from the declared content type, reducing exposure to drive-by download attacks.
 nosniff
8/8
  • ✓ nosniff is set correctly.
âš  Content-Security-Policy CSP
The most powerful security header. It controls which resources the browser may load, which mitigates XSS, data injection and other code injection attacks.
 default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com github.githubassets.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net productionresultssa1.blob.core.windows.net productionresultssa2.blob.core.windows.net productionresultssa3.blob.core.windows.net productionresultssa4.blob.core.windows.net productionresultssa5.blob.core.windows.net productionresultssa6.blob.core.windows.net productionresultssa7.blob.core.windows.net productionresultssa8.blob.core.windows.net productionresultssa9.blob.core.windows.net productionresultssa10.blob.core.windows.net productionresultssa11.blob.core.windows.net productionresultssa12.blob.core.windows.net productionresultssa13.blob.core.windows.net productionresultssa14.blob.core.windows.net productionresultssa15.blob.core.windows.net productionresultssa16.blob.core.windows.net productionresultssa17.blob.core.windows.net productionresultssa18.blob.core.windows.net productionresultssa19.blob.core.windows.net productionresultssa30.blob.core.windows.net productionresultssa31.blob.core.windows.net productionresultssa32.blob.core.windows.net github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com wss://alive-staging.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com wss://production-copilot-host.webpubsub.azure.com wss://production-copilot-host-centralus.webpubsub.azure.com wss://production-copilot-host-centralus-02.webpubsub.azure.com wss://production-copilot-host-westus.webpubsub.azure.com wss://production-copilot-host-westus3.webpubsub.azure.com wss://production-copilot-host-eastasia.webpubsub.azure.com wss://production-copilot-host-austriaeast.webpubsub.azure.com api.github.com/cmc_internal/api/ edge.fullstory.com rs.fullstory.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com www.youtube-nocookie.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com user-images.githubusercontent.com private-user-images.githubusercontent.com opengraph.githubassets.com repository-images.githubusercontent.com marketplace-screenshots.githubusercontent.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com explore-feed.github.com *.googleusercontent.com objects-origin.githubusercontent.com *.githubusercontent.com images.ctfassets.net/8aevphvgewt8/; manifest-src 'self'; media-src github.com user-images.githubusercontent.com secured-user-images.githubusercontent.com private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com github.githubassets.com assets.ctfassets.net/8aevphvgewt8/ videos.ctfassets.net/8aevphvgewt8/; script-src github.githubassets.com 'sha256-6AKuI+cDd1MoUL1u4eqrA9PXmnPAkOB4h7421hPUUm0='; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/
21/25
  • âš  'unsafe-inline' is present, which weakens XSS protection. Use nonces or hashes instead.
  • ✓ No 'unsafe-eval' was found.
  • ✓ The default-src fallback directive is set.
  • ✓ frame-ancestors is set, which controls iframe embedding at the CSP level.
  • ✓ upgrade-insecure-requests is set.
  • ✓ base-uri is set, which prevents base tag injection.
✓ Referrer-Policy RP
Controls how much referrer information is sent with requests. Restricting it protects user privacy and avoids leaking sensitive URLs.
 origin-when-cross-origin, strict-origin-when-cross-origin
8/8
  • ✓ The policy is a safe choice.
  • ✓ This is the recommended balanced policy.
✗ Permissions-Policy PP
Controls access to browser features and APIs such as the camera, microphone and geolocation. Replaces the deprecated Feature-Policy header.
 Not set
0/8
  • âš  Permissions-Policy is missing. Scripts may use browser features like the camera, microphone and geolocation without restriction.
Recommended: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
✓ X-XSS-Protection XXP
Legacy header for the XSS filter in older browsers. Modern browsers ignore it and a strong CSP is preferred. A wrong value can introduce vulnerabilities.
 0
5/5
  • ✓ It is set to 0, the correct modern value, which turns off the buggy legacy XSS filter.
✗ Cross-Origin-Embedder-Policy COEP
Prevents a document from loading cross-origin resources that do not explicitly grant permission. Required for cross-origin isolation.
 Not set
0/7
  • âš  COEP is not set. It is required for cross-origin isolation, which enables features like SharedArrayBuffer.
Recommended: require-corp
✗ Cross-Origin-Opener-Policy COOP
Isolates the browsing context group, which protects against cross-origin attacks such as XS-Leaks and Spectre.
 Not set
0/7
  • âš  COOP is not set. The browsing context is not isolated, which leaves the site open to XS-Leaks and Spectre-style attacks.
Recommended: same-origin
✗ Cross-Origin-Resource-Policy CORP
Says whether other sites may include the resource, which protects against some cross-origin information leaks and side-channel attacks.
 Not set
0/7
  • âš  CORP is not set. Other sites may be able to include your resources, which can enable information leaks.
Recommended: same-origin

Information disclosure check

These headers may reveal details about the server software and technology stack.

Risk Header Value Advice
medium Server github.com Remove or mask the Server header so it does not disclose the web server software and version.