How to Fix Missing Security Headers

What the security headers check tests

SiteCurl checks for six security headers in your server response: Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Cross-Origin-Opener-Policy (COOP), and Permissions-Policy. Each missing or misconfigured header is flagged separately.

For CSP, SiteCurl also checks for weaknesses like unsafe-inline and unsafe-eval in the script-src directive.

Why it matters

Without security headers, browsers use permissive defaults that leave your visitors exposed:

• No X-Frame-Options: Your pages can be embedded in hidden frames for clickjacking attacks
• No X-Content-Type-Options: Browsers may guess file types and execute uploaded files as scripts
• No Referrer-Policy: Full page URLs (including private paths) are shared with external sites
• No COOP: Malicious sites can interact with your pages through popup windows
• No Permissions-Policy: Embedded third-party content can access camera, microphone, and location

How to fix it

Add all five headers to your server setup. For detailed CSP guidance, see our Content-Security-Policy article.

Nginx

add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Cross-Origin-Opener-Policy "same-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

Apache

Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Cross-Origin-Opener-Policy "same-origin"
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"

CDN or hosting panel

Most CDNs (Cloudflare, Vercel, Netlify) let you add custom headers in the dashboard or a config file. Check your provider’s documentation.

How to verify the fix

Run a SiteCurl scan and check the security section. Each header should show as passed. You can also check manually:

curl -sI https://yoursite.com | grep -iE "x-frame|x-content|referrer|opener|permissions"

Related checks

Security headers work alongside your Content-Security-Policy and HTTPS/HSTS setup. All three layers together form a complete browser security policy.

Start a free trial to audit all security headers on your site.