Your security headers, and whether you can even change them
A handful of headers decide how much a browser will protect your visitors. This reads them, says which ones actually matter, and — the part other checkers skip — tells you when the answer is your website builder’s and not yours.
Every scanner will grade you red for a missing header. Almost none will tell you it is unfixable on your platform.
We also try the plain http:// address,
to see whether it forwards to the secure one.
A missing header is not a break-in. None of this means anyone
has touched your site. These headers make certain attacks harder;
without them your site works exactly as it does now. Anyone who reports
a missing Referrer-Policy as a breach is selling fear.
The two worth acting on. Forwarding http:// to
https://, and Strict-Transport-Security with a
long enough life. Those two close a real gap: the very first request a
visitor makes, before any encryption exists. The rest are worth having
and are rarely urgent.
Whose job it is. On a hosted builder — Wix, Squarespace, Shopify, Webflow — you are not running the web server, so response headers are the platform’s to send. What any one plan lets you override differs between them and changes over time, and we do not track that. What we can do is tell you when the site is on one, so that a missing header goes to your platform’s support rather than onto your own to-do list. Ask them before you assume it is yours.
What this is not. One or two ordinary requests to your home page, the same as any visitor makes. It is not a penetration test, it probes nothing, and it visits no other address on your site. We do not run active security testing against a domain without written permission from whoever owns it.