Check which HTTP security headers your website sends, how well they are configured and what is missing. Each missing or weak header comes with the line to add to your server configuration.
CSP is the main defence against cross-site scripting. The checker verifies that a policy exists and flags weak directives such as unsafe-inline, unsafe-eval, wildcards and a missing default-src.
These headers force HTTPS, block clickjacking and stop MIME-type sniffing. The scan checks that each one is present and correctly configured, including the HSTS max-age.
WebGuard AI also checks Referrer-Policy, Permissions-Policy and the modern isolation headers COOP, COEP and CORP, and warns when Server or X-Powered-By headers reveal software versions.
At minimum: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options (or CSP frame-ancestors), X-Content-Type-Options: nosniff, Referrer-Policy and Permissions-Policy.
Add them in your web server (nginx add_header, Apache Header set, IIS customHeaders), in your CDN, or in your application. The report gives the exact line for each missing header.
Each header has a weight based on its impact (CSP and HSTS weigh the most). Points are removed for weak configurations such as unsafe-inline in CSP or a short HSTS max-age.