2 min read
Security headers are HTTP response headers that tell browsers how to behave: blocking downgrade attacks, clickjacking, content injection, and MIME-sniffing. XPulse audits your site for the recommended set; when any are missing, the site is flagged.
SECURITY_HEADERS (warning): not all recommended security headers are present.
| Header | What it protects against | Example value |
|---|---|---|
| Strict-Transport-Security (HSTS: | Downgrade attacks) forces browsers to always use HTTPS | max-age=31536000; includeSubDomains |
| X-Frame-Options | Clickjacking: blocks your site being framed | SAMEORIGIN |
| X-Content-Type-Options | MIME-sniffing attacks | nosniff |
| Referrer-Policy | Data leakage: controls what’s sent in the Referer header | strict-origin-when-cross-origin |
| Content-Security-Policy (CSP) | Content injection/XSS: restricts what scripts/content load | default-src 'self' (tune per site) |
| Permissions-Policy | Feature abuse: restricts browser features (camera, mic, geolocation) | geolocation=(), microphone=() |
| Layer | How |
|---|---|
| Server level (recommended) | GridPane/OLS: headers in the server config (applies to everything, Xponent does this) |
| CDN | Cloudflare: Transform Rules / Headers: applies at the edge |
| WordPress (plugin) | Security plugins or .htaccess (only if the server can’t) |
max-age but don’t add includeSubDomains until all subdomains are HTTPS: it can lock out HTTP-only subdomains.Nothing. If you have a third-party service that needs an embed or iframe (booking widget, video, chat), tell us before we lock headers down, and we’ll configure exceptions so features keep working.
All Xponent-managed sites ship with the full header set configured server-level. Incomplete headers usually mean the site isn’t on the stack yet, or something (a security plugin, CDN, or manual config) is stripping them. We apply headers and verify nothing breaks.
