HeaderHound

Security headers report for Drupal

https://www.drupal.org

Report generated: Sunday, 15 November 2026 - 18:45

Print this page or use your browser's Save as PDF to keep a copy.

View the live report

D 52%

Overall security score

51 out of 98 points

Poor. Critical security headers are missing and the site is significantly exposed.

A+ and A: excellent B and C: needs work D and F: critical issues

Security header analysis

Status Header Current value Score Findings and recommendations
âš  Strict-Transport-Security HSTS
Tells browsers to only use HTTPS for all future requests. Prevents protocol downgrade attacks and cookie hijacking.
 max-age=15552000; includeSubDomains; preload
12/15
  • âš  max-age is less than one year. Consider raising it to 31536000 (one year) or more.
  • ✓ includeSubDomains is set.
  • ✓ preload is set, so the site is eligible for the HSTS preload list.
✓ X-Frame-Options XFO
Protects against clickjacking by controlling whether the site can be embedded in iframes. Largely superseded by CSP frame-ancestors but still widely supported.
 SAMEORIGIN
8/8
  • ✓ SAMEORIGIN allows embedding only by pages on the same origin.
✓ X-Content-Type-Options XCTO
Prevents browsers from MIME-sniffing a response away from the declared content type, reducing exposure to drive-by download attacks.
 nosniff
8/8
  • ✓ nosniff is set correctly.
âš  Content-Security-Policy CSP
The most powerful security header. It controls which resources the browser may load, which mitigates XSS, data injection and other code injection attacks.
 frame-ancestors 'self'
16/25
  • âš  default-src is missing, so browsers have no fallback directive.
  • âš  base-uri is missing. Without it, an attacker who can inject a base tag can hijack relative URLs.
  • ✓ No 'unsafe-inline' was found.
  • ✓ No 'unsafe-eval' was found.
  • ✓ frame-ancestors is set, which controls iframe embedding at the CSP level.
✗ Referrer-Policy RP
Controls how much referrer information is sent with requests. Restricting it protects user privacy and avoids leaking sensitive URLs.
 Not set
0/8
  • âš  Referrer-Policy is missing. Browsers may send the full URL to third-party sites as the referrer.
Recommended: strict-origin-when-cross-origin
âš  Permissions-Policy PP
Controls access to browser features and APIs such as the camera, microphone and geolocation. Replaces the deprecated Feature-Policy header.
 interest-cohort=()
4/8
  • âš  "camera" is not controlled. Consider adding camera=() to turn it off.
  • âš  "microphone" is not controlled. Consider adding microphone=() to turn it off.
  • âš  "geolocation" is not controlled. Consider adding geolocation=() to turn it off.
  • âš  "payment" is not controlled. Consider adding payment=() to turn it off.
  • ✓ Permissions-Policy is set.
âš  X-XSS-Protection XXP
Legacy header for the XSS filter in older browsers. Modern browsers ignore it and a strong CSP is preferred. A wrong value can introduce vulnerabilities.
 Not set
3/5
  • âš  X-XSS-Protection is not set. Modern browsers ignore it, but setting it to 0 is still recommended to avoid bugs in older browsers.
Recommended: 0
✗ Cross-Origin-Embedder-Policy COEP
Prevents a document from loading cross-origin resources that do not explicitly grant permission. Required for cross-origin isolation.
 Not set
0/7
  • âš  COEP is not set. It is required for cross-origin isolation, which enables features like SharedArrayBuffer.
Recommended: require-corp
✗ Cross-Origin-Opener-Policy COOP
Isolates the browsing context group, which protects against cross-origin attacks such as XS-Leaks and Spectre.
 Not set
0/7
  • âš  COOP is not set. The browsing context is not isolated, which leaves the site open to XS-Leaks and Spectre-style attacks.
Recommended: same-origin
✗ Cross-Origin-Resource-Policy CORP
Says whether other sites may include the resource, which protects against some cross-origin information leaks and side-channel attacks.
 Not set
0/7
  • âš  CORP is not set. Other sites may be able to include your resources, which can enable information leaks.
Recommended: same-origin

Information disclosure check

These headers may reveal details about the server software and technology stack.

Risk Header Value Advice
medium Server Apache Remove or mask the Server header so it does not disclose the web server software and version.
medium X-Generator Drupal 11 (https://www.drupal.org) Remove the X-Generator header so it does not disclose your CMS and its version.
low X-Drupal-Cache HIT The X-Drupal-Cache header reveals that the site runs Drupal. Consider removing it in production.
low X-Drupal-Dynamic-Cache UNCACHEABLE (poor cacheability) The X-Drupal-Dynamic-Cache header reveals Drupal's caching internals. Consider removing it in production.
low Via 1.1 varnish The Via header reveals proxy server information. Consider masking it in production.