HeaderHound

Security headers report for Drupal

https://sparknotes.com

Report generated: Sunday, 15 November 2026 - 19:45

Print this page or use your browser's Save as PDF to keep a copy.

View the live report

F 3%

Overall security score

3 out of 98 points

Failing. Most security headers are missing or misconfigured. Act on this now.

A+ and A: excellent B and C: needs work D and F: critical issues

Security header analysis

Status Header Current value Score Findings and recommendations
✗ Strict-Transport-Security HSTS
Tells browsers to only use HTTPS for all future requests. Prevents protocol downgrade attacks and cookie hijacking.
 Not set
0/15
  • âš  HSTS is not set. All modern sites should redirect to HTTPS and set this header with a long max-age.
Recommended: max-age=31536000; includeSubDomains; preload
✗ X-Frame-Options XFO
Protects against clickjacking by controlling whether the site can be embedded in iframes. Largely superseded by CSP frame-ancestors but still widely supported.
 Not set
0/8
  • âš  X-Frame-Options is missing. Other sites may be able to embed your pages in iframes, which enables clickjacking.
Recommended: SAMEORIGIN
✗ X-Content-Type-Options XCTO
Prevents browsers from MIME-sniffing a response away from the declared content type, reducing exposure to drive-by download attacks.
 Not set
0/8
  • âš  X-Content-Type-Options is missing. Browsers may MIME-sniff responses, which can enable drive-by download attacks.
Recommended: nosniff
✗ Content-Security-Policy CSP
The most powerful security header. It controls which resources the browser may load, which mitigates XSS, data injection and other code injection attacks.
 Not set
0/25
  • âš  CSP is not set. It is the most important security header: it controls which resources can be loaded and mitigates XSS attacks.
Recommended: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests
✗ Referrer-Policy RP
Controls how much referrer information is sent with requests. Restricting it protects user privacy and avoids leaking sensitive URLs.
 Not set
0/8
  • âš  Referrer-Policy is missing. Browsers may send the full URL to third-party sites as the referrer.
Recommended: strict-origin-when-cross-origin
✗ Permissions-Policy PP
Controls access to browser features and APIs such as the camera, microphone and geolocation. Replaces the deprecated Feature-Policy header.
 Not set
0/8
  • âš  Permissions-Policy is missing. Scripts may use browser features like the camera, microphone and geolocation without restriction.
Recommended: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
âš  X-XSS-Protection XXP
Legacy header for the XSS filter in older browsers. Modern browsers ignore it and a strong CSP is preferred. A wrong value can introduce vulnerabilities.
 Not set
3/5
  • âš  X-XSS-Protection is not set. Modern browsers ignore it, but setting it to 0 is still recommended to avoid bugs in older browsers.
Recommended: 0
✗ Cross-Origin-Embedder-Policy COEP
Prevents a document from loading cross-origin resources that do not explicitly grant permission. Required for cross-origin isolation.
 Not set
0/7
  • âš  COEP is not set. It is required for cross-origin isolation, which enables features like SharedArrayBuffer.
Recommended: require-corp
✗ Cross-Origin-Opener-Policy COOP
Isolates the browsing context group, which protects against cross-origin attacks such as XS-Leaks and Spectre.
 Not set
0/7
  • âš  COOP is not set. The browsing context is not isolated, which leaves the site open to XS-Leaks and Spectre-style attacks.
Recommended: same-origin
✗ Cross-Origin-Resource-Policy CORP
Says whether other sites may include the resource, which protects against some cross-origin information leaks and side-channel attacks.
 Not set
0/7
  • âš  CORP is not set. Other sites may be able to include your resources, which can enable information leaks.
Recommended: same-origin

Information disclosure check

These headers may reveal details about the server software and technology stack.

Risk Header Value Advice
medium Server AkamaiGHost Remove or mask the Server header so it does not disclose the web server software and version.