Content Security Policy (CSP)
CSP limits which sources a browser may use for scripts, styles, and other content. A restrictive policy can reduce the impact of some injection flaws, but it can also block legitimate assets. Start by mapping required sources; a report-only policy can help observe violations before enforcement.
HTTP Strict Transport Security (HSTS)
HSTS tells supporting browsers to use HTTPS for a host for a specified period. Before enabling a long duration or including subdomains, confirm that every affected hostname works correctly over HTTPS. A mistaken policy can be difficult for returning visitors to bypass while it remains cached.
X-Content-Type-Options and other headers
X-Content-Type-Options: nosniff asks browsers not to reinterpret declared content types in relevant cases. A Referrer-Policy sets how much page address information is sent with requests. Choose values that fit the application and test them with real pages and flows; a single score is not a substitute for that review.
What Guardian observes
Guardian can check supported HTTP security headers at the monitored public endpoint of a verified domain. It can show a missing or changed signal and a response path. It cannot prove that all routes have the same headers or that an application is free of vulnerabilities. Make configuration changes at your server, CDN, or application, then verify the public response.
- Inspect the response from the public hostname.
- Test proposed policies on real application routes.
- Recheck the public endpoint after deployment.