Guides · Security

Four small security settings for your site

When your server sends a page, it also sends short settings called response headers. Visitors never see them, but the browser follows them. Your report lists any of four common settings that are missing. Each one tells the browser about a small limit to apply. They are low priority, and each one is a single line of server configuration.

What each one does

The exact values

X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

Our test needs nosniff exactly. For the other three, it checks that the header is present.

Your report suggests DENY for frame protection. That value blocks all framing, and SAMEORIGIN still allows your own site. Choose DENY only if no page of yours is ever shown in a frame.

A Content-Security-Policy header containing frame-ancestors also counts as frame protection.

What can go wrong

Frame protection is the setting most likely to cause a visible problem. It stops any blocked site from showing your page in a frame. A partner, booking site or app that embeds your page would then show an empty space. DENY may also break a site editor that previews your page in a frame.

To allow one outside site, a developer can use this instead:

Content-Security-Policy: frame-ancestors 'self' https://partner.example

The other three can also have effects:

• nosniff makes the browser refuse a script or stylesheet sent with the wrong file type. Test your pages after adding it.
• Permissions-Policy switches off a feature you may use, such as a "find my nearest store" button. Allow your own site with geolocation=(self), or remove that feature from the list.
• Referrer-Policy means analytics on other sites may see only your domain. Current browsers often behave this way already, so the header usually changes little.

Who can set them

How you set these headers depends on who runs your server.

1. Your own hosting: ask the host or developer to add the lines above to the server configuration for all pages. On WordPress, a header plugin may also work, although a page cache can get in the way.
2. A CDN in front of your site: many CDNs can add response headers in their rules settings.
3. Shopify, Wix or Squarespace: these platforms run the server for you and often have no setting for custom headers. Their help pages or support can tell you. If there is no option, these items can stay.

A tag in the page itself does not replace these headers, because our test reads the server's response.

Open your site in a private window and try the features you use, such as forms, maps and videos. To confirm the change, press Rescan on your report.