Visual guides

HTTP security headers

HTTP security headers tell the browser how to protect a page against certain attacks and data leaks.

Protected web response

Request Server Headers Browser

HSTS

Forces HTTPS when configured correctly.

Reduces risks from unauthorized scripts or resources.

Controls what URL is shared as a referrer.

HSTS, Content-Security-Policy, X-Frame-Options or frame-ancestors, Referrer-Policy and Permissions-Policy are common key signals.

Not every policy should be copied blindly: a bad CSP can break scripts, payments or analytics.

MyIPPublic reviews presence and basic signals. The final decision should consider the application, allowed domains and real compatibility.

FAQ

Does missing CSP mean vulnerable?

Not automatically, but it is a recommended improvement for many applications.

Can I always enable HSTS?

Only if the whole site and required subdomains work correctly over HTTPS.