Missing security headers: a safe fix plan for a small website
A missing header is a configuration observation. The best fix depends on where your website terminates HTTPS and how your application serves content.
Locate the response owner
Your response may come from an application, IIS or another web server, a reverse proxy, a CDN, or several layers. Inspect the browser-facing response for each hostname and redirect. Make the change at the layer that consistently controls the public response; document any exceptions.
HSTS: confirm HTTPS readiness first
HTTP Strict Transport Security tells supporting browsers to use HTTPS for future visits after receiving the header over HTTPS. Before enabling a long duration, verify valid certificates, working HTTPS for the hostname, and redirects from HTTP. Start with a short max-age and test. Add includeSubDomains only after every affected subdomain is HTTPS-ready. Preload is a separate, high-commitment choice requiring its own review.
CSP: inventory content before enforcement
Content Security Policy can restrict where scripts, styles and other resources load. Inventory first-party and third-party dependencies. Introduce a narrowly planned policy in report-only mode where feasible, review reports and browser console errors, and then enforce with a tested rollout. A copied policy that breaks an appointment form or payment flow is not a useful security fix.
Verify by hostname
- Deploy to staging, test key pages and forms, and keep a rollback plan.
- Request the public URL for each hostname and inspect the final HTTPS response, including any CDN behavior.
- Run a new scan to check the observed header status, and also test browser behavior. A reported header alone does not prove its policy is effective.
Torva can report supported header observations on public web responses. It cannot guarantee that a CSP policy is complete or that every application path was tested.
Check your own domain. Try the public DNS, certificate and header instant check, then see Edge coverage for verified-domain scanning.
Further reading
Keep learning
One security fix can address several findings: how to group the work · External vs. internal security scans: what each can see · All guides