Missing header
security.headers.missing_header
- Outcome class
- Automatic. An automated check that can report a confirmed violation.
- Area
- Security, response headers
What the checks look at
Content-Security-Policy
Scope. Applies to every successfully fetched document response. Always applicable: the check judges the response itself (its transport or one of its headers), and every successfully fetched response has a scheme and a header set, so no page lies outside its scope.
Expectation. Fails when the response carries no enforced Content-Security-Policy header. A Content-Security-Policy-Report-Only header does not enforce anything (CSP3, report-only header) and does not count. Field names are case-insensitive (RFC 9110 §5.1); several CSP headers form one policy list and count as present.
Always applicable: every document response is in scope. Known gap: a policy delivered by <meta http-equiv> (CSP3, 'The <meta> element') is enforced by browsers but not read by this header-only analyzer.
Source. CSP Level 3, 'The Content-Security-Policy HTTP Response Header Field' and 'Policy lists'; OWASP Secure Headers Project
Detection: analyze_security; needs network.
Failing example
The check reports a violation here. Corpus case security_csp_report_only. The case is a set of response headers; there is no page.
Content-Security-Policy-Report-Only: default-src 'none'; script-src 'unsafe-inline'
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: geolocation=(), camera=()
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-Frame-Options: DENYPassing example
The check passes here and reports nothing. Corpus case security_https_complete. The case is a set of response headers; there is no page.
Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: geolocation=(), camera=()
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: DENYCross-Origin-Opener-Policy
Scope. Applies to every successfully fetched top-level document response. Always applicable: the check judges the response itself (its transport or one of its headers), and every successfully fetched response has a scheme and a header set, so no page lies outside its scope.
Expectation. Reports a review (needs_review), never a confirmed violation, when the response sets no Cross-Origin-Opener-Policy: COOP is an opt-in isolation mechanism whose need depends on deployment context (SharedArrayBuffer, cross-origin popups) that a single fetch cannot observe, so the finding asks a human to verify. A present header passes.
Source. HTML Standard, 'Cross-origin opener policies'; auditmysite #578 header tiers
Detection: analyze_security; needs network.
Passing example
The check passes here and reports nothing. Corpus case security_https_complete. The case is a set of response headers; there is no page.
Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: geolocation=(), camera=()
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: DENYCross-Origin-Resource-Policy
Scope. Applies to every successfully fetched response. Always applicable: the check judges the response itself (its transport or one of its headers), and every successfully fetched response has a scheme and a header set, so no page lies outside its scope.
Expectation. Reports a review (needs_review), never a confirmed violation, when the response sets no Cross-Origin-Resource-Policy: whether other origins may embed the resource is a deployment decision a single fetch cannot observe. A present header passes.
Source. Fetch Standard, 'Cross-Origin-Resource-Policy header'; auditmysite #578 header tiers
Detection: analyze_security; needs network.
Passing example
The check passes here and reports nothing. Corpus case security_https_complete. The case is a set of response headers; there is no page.
Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: geolocation=(), camera=()
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: DENYPermissions-Policy
Scope. Applies to every successfully fetched document response. Always applicable: the check judges the response itself (its transport or one of its headers), and every successfully fetched response has a scheme and a header set, so no page lies outside its scope.
Expectation. Fails when the response has no Permissions-Policy header. A present but empty or all-wildcard header is Permissions-Policy:permissions_policy_permissive, not this id.
Source. Permissions Policy (W3C), 'The Permissions-Policy HTTP header field'; OWASP Secure Headers Project
Detection: analyze_security; needs network.
Failing example
The check reports a violation here. Corpus case no_headers_at_all. The case is a set of response headers; there is no page.
The server sends no header the check looks at.
Passing example
The check passes here and reports nothing. Corpus case security_https_complete. The case is a set of response headers; there is no page.
Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: geolocation=(), camera=()
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: DENYReferrer-Policy
Scope. Applies to every successfully fetched document response. Always applicable: the check judges the response itself (its transport or one of its headers), and every successfully fetched response has a scheme and a header set, so no page lies outside its scope.
Expectation. Fails when the response has no Referrer-Policy header. Field names are case-insensitive. Known gap: <meta name="referrer"> (HTML, 'Standard metadata names: referrer') also sets the policy and is not read by this header-only analyzer.
Source. Referrer Policy (W3C), 'Delivery via Referrer-Policy header'; OWASP Secure Headers Project
Detection: analyze_security; needs network.
Failing example
The check reports a violation here. Corpus case no_headers_at_all. The case is a set of response headers; there is no page.
The server sends no header the check looks at.
Passing example
The check passes here and reports nothing. Corpus case security_https_complete. The case is a set of response headers; there is no page.
Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: geolocation=(), camera=()
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: DENYStrict-Transport-Security
Scope. Applies to documents served over HTTPS; over plain HTTP the header is ignored by user agents, so the check does not apply.
Expectation. Fails when an HTTPS response carries no Strict-Transport-Security header. Over plain HTTP the check does not apply (not_applicable), with or without the header. Field names are case-insensitive.
Source. RFC 6797 §6.1 (STS header), §7.2 and §8.1 (the header is only honoured over secure transport)
Detection: analyze_security; needs network.
Failing example
The check reports a violation here. Corpus case security_https_without_hsts. The case is a set of response headers; there is no page.
Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: geolocation=(), camera=()
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-Frame-Options: DENYPassing example
The check passes here and reports nothing. Corpus case hsts_preload_eligible. The case is a set of response headers; there is no page.
Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: geolocation=(), camera=()
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: DENYX-Content-Type-Options
Scope. Applies to every successfully fetched document response. Always applicable: the check judges the response itself (its transport or one of its headers), and every successfully fetched response has a scheme and a header set, so no page lies outside its scope.
Expectation. Fails when the response has no X-Content-Type-Options header; nosniff is the only defined value. Field names are case-insensitive.
Source. Fetch Standard, 'X-Content-Type-Options header'; OWASP Secure Headers Project
Detection: analyze_security; needs network.
Failing example
The check reports a violation here. Corpus case no_headers_at_all. The case is a set of response headers; there is no page.
The server sends no header the check looks at.
Passing example
The check passes here and reports nothing. Corpus case security_https_complete. The case is a set of response headers; there is no page.
Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: geolocation=(), camera=()
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: DENYX-Frame-Options
Scope. Applies to document responses whose enforced CSP sets no frame-ancestors directive; with frame-ancestors, X-Frame-Options is not consulted at all.
Expectation. Fails when neither X-Frame-Options nor an enforced CSP frame-ancestors directive protects the document against framing. With frame-ancestors present the check does not apply (not_applicable), whether XFO is set or not; a report-only CSP's frame-ancestors does not count. XFO DENY/SAMEORIGIN passes.
Source. HTML Standard, 'The X-Frame-Options header' (a CSP frame-ancestors directive takes precedence); RFC 7034; OWASP Clickjacking Defense Cheat Sheet
Detection: analyze_security; needs network.
Failing example
The check reports a violation here. Corpus case no_headers_at_all. The case is a set of response headers; there is no page.
The server sends no header the check looks at.
Passing example
The check passes here and reports nothing. Corpus case security_https_complete. The case is a set of response headers; there is no page.
Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Permissions-Policy: geolocation=(), camera=()
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-Frame-Options: DENYThis page is generated from the rule catalogue and the rule contracts; see therule overview for how the outcome classes are derived.