Best practices

Response sends the standard security headers

Low impact · weight 4 · worth up to 1.1 points of the total score

Why it matters

A handful of response headers switch on protections the browser already has: HSTS keeps visitors on HTTPS, a Content-Security-Policy limits where scripts may come from, nosniff stops files being run as the wrong type, frame protection stops the page being embedded to trick clicks, and Referrer-Policy and Permissions-Policy limit what leaks and what the page may ask for. Security scanners and clients' IT teams grade sites on exactly this list.

How to fix it

Add the missing headers in the web server or CDN, for example Strict-Transport-Security: max-age=31536000, X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, Referrer-Policy: strict-origin-when-cross-origin. Roll out a Content-Security-Policy in report-only mode first.

Check a page for this, and the other 70 checks at once

More Best practices checks

No JavaScript errors in the console

An error logged while the page loads usually means a script stopped halfway: a menu that does not open, a form that does not submit, an analytics tag that records nothing. Visitors never see the message, only the broken behaviour.

No deprecated presentational tags

Tags like <center> and <font> were removed from the standard. Browsers still honour them today, but they mix styling into the markup and no longer respond to CSS the way the rest of the page does.

Page declares a favicon

The favicon is how a user finds this tab among twenty others and how the site appears in bookmarks and history. Without a declared one the browser requests /favicon.ico and usually gets a 404.

Styling lives in stylesheets, not attributes

Inline style attributes cannot be cached, overridden by a stylesheet, or covered by a Content Security Policy that forbids inline styles. In quantity they also bloat every HTML response.

See all checks