Security Headers

Summary#

Security Headers requests your site the way a browser does, reads every HTTP response header it sends back, and grades eleven of them for security posture. It returns a score out of 100, a per-header verdict, a copy-ready snippet for every gap, and a downloadable configuration bundle for Nginx, Apache and Cloudflare. It costs nothing.

Purpose#

Response headers are instructions your server gives every browser before a single pixel is drawn: only load scripts from these origins, never render me in someone else's frame, always use HTTPS from now on, do not guess this file's type. They are the cheapest security control in existence — a handful of configuration lines with no code change — and most sites send almost none of them.

They also feed Lighthouse's Best Practices score and the trust signals Chrome shows to your visitors, which is why this sits in Site Health rather than in a security corner of the app.

The decision it helps you make is which header to add next, and exactly what to paste.

Overview#

You give it a domain. Metric Vault makes a real HTTP request to it, follows redirects, and captures the complete response header set. Eleven checks then run against those headers: seven security headers, two caching headers, and two information-disclosure checks that pass when a header is absent rather than present.

Each check resolves to pass, warning or critical. The score starts at 100 and subtracts 15 per critical and 5 per warning. Everything shown is read from the live response — no assumptions and no scanning of your configuration files.

Benefits#

• Copy-ready fixes. Every missing header comes with the exact directive line, one click to copy.
• A configuration bundle. Generate File produces a text file containing raw snippets plus ready-made Nginx, Apache and Cloudflare Worker versions.
• Catches information leaks, not just missing protections — a verbose Server or X-Powered-By header tells attackers what you run.
• Plain-language impact. Each result is explained in terms of what an attacker could do and what Google sees.
• Free on every plan, with the complete raw header list included.

Use Cases#

• Hardening a new site before launch. Ten minutes of configuration closes the common web attack classes.
• Answering a security questionnaire. Export the PDF as evidence of your current header posture.
• Raising a Lighthouse Best Practices score. Missing headers are among the easiest points to recover — see PageSpeed & Vitals.
• Auditing a client's infrastructure on day one. The score and the critical count are a one-screen summary you can act on immediately.
• Confirming a change deployed. Re-run after a config push; every run is a fresh fetch.

Requirements#

• A signed-in Metric Vault account.
• Any plan, including Free.
• A publicly reachable domain. Private, internal and loopback hosts are refused.
• No credits, no integration, no ownership check.

Permissions#

No role restriction applies. See Roles and what each can do.

Cost#

0 credits. The button reads Check Headers · FREE. The run never touches your monthly credit allowance and counts only toward the fair-use limit of 100 light-tool calls per hour. See How credits work and What you get on Free.

There is no result cache and no "You already ran this" prompt — every run fetches the site again, so a configuration change shows up immediately.

Navigation Path#

Dashboard → Site Health → Security Headers

Inputs#

Step-by-Step Guide#

1. Open Dashboard → Site Health → Security Headers.
2. Optionally click See example for a free preview of the report.
3. Type your domain into the field marked e.g. nike.com.
4. Click Check Headers · FREE, or press Enter.
5. Read the Security Score and the four KPI tiles.
6. Work down Header Checks, clicking Add beside any warning or missing header to copy its snippet.
7. Click Generate File to download a complete bundle with Nginx, Apache and Cloudflare Worker versions, or Export PDF for a report.
8. Deploy your changes and re-run to confirm.

Reading the Results#

The header band. Your domain with a Live HTTP badge, the label "Security headers audit", and a status pill: Excellent (90+), Good (70-89), Needs Work (50-69) or Critical (below 50). Three actions sit on the right — Export PDF, Generate File and Schedule — and they repeat in a floating bar as you scroll.

The four KPI tiles.

Security Score. A meter reading N/100. It starts at 100 and subtracts 15 per critical and 5 per warning, so a single critical costs the same as three warnings. In practice only one check can go critical: serving over plain HTTP. Below the meter sits "Verified · Live HTTP fetch · Scanned just now".

What good looks like: 90+ with zero criticals. What bad looks like: anything below 50, or any critical at all.

Header Checks. All eleven checks, each as a card with the header name, the value found (or what is missing), a badge reading PRESENT, WARNING or MISSING, and an Add button that copies a working directive to your clipboard:

The last two are inverted: a pass means the header is hidden. If your report says "Exposes: nginx/1.21.6" or "Exposes: PHP/8.1.2", remove those headers in your server configuration.

Recommended Headers. Nine industry-standard headers with a one-line explanation and a Copy button, each marked CONFIGURED, MISSING · CRITICAL or MISSING · RECOMMENDED:

Start at the top. HSTS and CSP are marked critical here because they close the two largest attack classes, and the order of the table is the order to work in.

What This Means. Three plain-language insights: your verdict (Strong security posture at 80+, Needs hardening at 50-79, Critical gaps below 50) with the pass/warning/critical counts; the security impact, which names the attacks currently possible; and the SEO and trust impact, which explains how headers affect Google's trust signals and your Lighthouse Best Practices score.

Recommended Next Steps. Up to five ordered actions, each naming one header to add or fix. If everything passes you get "Maintain — re-scan weekly to catch regressions."

All Response Headers. The complete raw header set your server returned, name and value. Read it once — sites frequently ship internal debugging headers they never intended to expose.

Examples#

Screenshots#

Tips#

• Generate File is the fastest route to a real fix. It writes one bundle with raw snippets plus Nginx, Apache and Cloudflare Worker versions of every header.
• Deploy CSP in report-only mode first. A strict Content-Security-Policy can break third-party scripts, and report-only lets you see what would break before it does.
• Set HSTS max-age short at first. preload is effectively irreversible for months, so prove your HTTPS setup before committing.
• Test a real content page as well as the home page. Many stacks apply headers per route.
• If you sit behind a CDN, add headers at the edge — it is usually one rule for the whole site.

Best Practices#

• Fix in table order: HTTPS, then HSTS, then CSP, then the rest.
• Remove Server version detail and X-Powered-By entirely. They benefit nobody except an attacker fingerprinting your stack.
• Set the headers once at the edge or in the base server configuration rather than per application, so new routes inherit them.
• Re-run after every infrastructure change. Headers are lost by CDN reconfiguration more often than by code.
• Use Schedule so a regression reaches you by email rather than by incident.

Common Mistakes#

• Adding a strict CSP straight to production. It will block your analytics, chat widget and payment scripts. Use report-only first.
• Setting X-Content-Type-Options to anything but nosniff. Any other value fails the check and does nothing.
• Treating X-XSS-Protection as protection. It is a legacy filter; the modern answer is CSP, which is why the recommended value here is 0.
• Only checking the home page. Headers are frequently route-specific.
• Relying on HSTS without HTTPS everywhere. HSTS on a site with mixed HTTP endpoints breaks them permanently for returning visitors.

Limitations#

• One URL per run, and headers can differ per path.
• Eleven checks. The Recommended Headers table covers nine industry-standard headers; anything outside those sets is listed raw but not graded.
• Presence, not correctness. The tool confirms a Content-Security-Policy exists; it does not evaluate whether your policy is strong. The one exception is X-Content-Type-Options, where the value must be nosniff.
• Only one check can go critical — serving over plain HTTP. Everything else is a warning, so a score of 95 can still hide a missing CSP.
• It reads what the server sent to Metric Vault. A CDN that varies headers by geography or user-agent may serve your visitors something different.
• This is not a penetration test. It grades response headers only.

Troubleshooting#

FAQs#

Does this cost credits? No. It is one of the zero-credit technical tools and runs on every plan, including Free.

What does the score actually measure? Eleven checks against your live response headers. The score starts at 100 and loses 15 per critical and 5 per warning. In practice only "not served over HTTPS" can be critical, so most real sites land between 50 and 100 on warnings alone.

My score is 95 but I have no Content-Security-Policy. Is that fine? No. A missing CSP is a warning, so it costs only 5 points, but CSP is the single strongest defence against cross-site scripting. Read the Recommended Headers table, not just the number.

What is the difference between the Header Checks list and the Recommended Headers list? Header Checks is what your site sent, graded. Recommended Headers is the industry-standard set, marked configured or missing, with a snippet for each. The lists overlap but are not identical — Recommended Headers includes X-XSS-Protection, Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy, which are not part of the eleven graded checks.

What exactly does Generate File download? A single text file named for your domain containing every recommended header three ways: as raw directive lines, as an Nginx add_header block, as an Apache Header always set block, and as a Cloudflare Worker script.

Do security headers help SEO? Indirectly, and the report says so plainly. They are not a ranking factor, but they raise Lighthouse's Best Practices score, they prevent the mixed-content and insecure-subresource warnings Chrome shows users, and HTTPS itself has been a positive signal for years.