What gets checked
Nattvakt makes a live request and reports whether your site sends HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy, and whether HTTP redirects to HTTPS.
What the key headers do
HSTS forces browsers onto HTTPS. Content-Security-Policy restricts where scripts and content may load from - the strongest defence against cross-site scripting. X-Content-Type-Options: nosniff stops MIME sniffing, and X-Frame-Options or frame-ancestors block clickjacking.
Rolling headers out safely
Add headers at your server or CDN edge. Test CSP in report-only mode first - a strict policy can break legitimate scripts. Start with the quick wins (HSTS, nosniff, frame protection) and layer CSP in gradually.
Frequently asked questions
What is HSTS?
Strict-Transport-Security - a header that tells browsers to only ever connect to your site over HTTPS, preventing protocol-downgrade attacks.
What does Content-Security-Policy do?
It whitelists the sources a page may load scripts, styles and other content from, and is the most effective defence against cross-site scripting (XSS).
Are security headers required?
They are not mandatory, but they are a cheap, high-impact way to protect visitors and are widely expected in security reviews.