What security headers does SiteReveal check?

SiteReveal checks 9 security signals: Content-Security-Policy (CSP), Strict-Transport-Security (HSTS), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Subresource Integrity (SRI), Cross-Origin-Opener-Policy (COOP), and HTTPS/TLS. These cover all headers evaluated by SecurityHeaders.io and Mozilla Observatory.

How does SiteReveal's security score compare to SecurityHeaders.io?

SiteReveal checks all 8 headers that SecurityHeaders.io evaluates, plus HTTPS/TLS as a 9th signal. SiteReveal additionally provides AI-generated fix recommendations for each missing header, score history over time, and a composite WIS™ score that contextualises security alongside performance, SEO, and technology signals.

How is the security score calculated?

The security dimension score is calculated from 9 signals with individual point values: CSP (20), HSTS (15), X-Frame-Options (10), X-Content-Type-Options (10), Referrer-Policy (10), Permissions-Policy (10), SRI (10), COOP (10), HTTPS (5). The maximum raw score is 100. The security dimension is weighted at 25% of the composite WIS™ score.

Security Dimension — 25% of WIS™

Website Security Score
Methodology

SiteReveal checks 9 security signals covering every header evaluated by SecurityHeaders.io, OWASP, and Mozilla Observatory — plus AI-generated fix recommendations for each gap. This page documents exactly how each signal is detected, scored, and weighted.

← Full Methodology

Security Score Formula

The security dimension is scored out of 100 from 9 independent signals. It contributes 25% of the composite WIS™ score — the highest weight of any single dimension, reflecting the critical importance of security to user trust and search engine ranking.

Security = CSP(20) + HSTS(15) + XFO(10) + XCTO(10)
+ RP(10) + PP(10) + SRI(10) + COOP(10) + TLS(5)
// Max raw score: 100 pts → normalised to 0–100

Signals checked

25%

Weight in WIS™

100

Max raw points

Signal Reference

All 9 Security Signals — Explained

Each signal is detected from live HTTP response headers and the rendered DOM. Click any header to see the exact detection logic, point value, and recommended fix.

Content-Security-PolicyCSPCritical

Restricts which resources (scripts, styles, images) the browser may load. Prevents XSS att…

What it does

Restricts which resources (scripts, styles, images) the browser may load. Prevents XSS attacks by blocking inline scripts and unauthorised external sources.

Recommended fix

Start with a strict CSP: `default-src 'self'; script-src 'self' 'nonce-{random}'; object-src 'none'; base-uri 'none'`. Use the CSP Evaluator tool at csp-evaluator.withgoogle.com to validate.

Example header value

Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-abc123'; object-src 'none'

Checked by

SiteReveal SecurityHeaders.io OWASP Mozilla Observatory

Strict-Transport-SecurityHSTSCritical

Forces browsers to use HTTPS for all future requests, preventing SSL-stripping attacks and…

What it does

Forces browsers to use HTTPS for all future requests, preventing SSL-stripping attacks and accidental HTTP connections.

Recommended fix

Set `max-age` to at least 31536000 (1 year). Add `includeSubDomains` and `preload` once you are confident all subdomains support HTTPS.

Example header value

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Checked by

SiteReveal SecurityHeaders.io OWASP Mozilla Observatory

X-Frame-OptionsXFOHigh

Prevents the page from being embedded in iframes on other domains, blocking clickjacking a…

What it does

Prevents the page from being embedded in iframes on other domains, blocking clickjacking attacks.

Recommended fix

Use `DENY` unless you specifically need iframe embedding. If you do need embedding, use CSP's `frame-ancestors` directive instead — it supersedes X-Frame-Options in modern browsers.

Example header value

X-Frame-Options: DENY

Checked by

SiteReveal SecurityHeaders.io OWASP Mozilla Observatory

X-Content-Type-OptionsXCTOHigh

Prevents browsers from MIME-sniffing a response away from the declared Content-Type, block…

What it does

Prevents browsers from MIME-sniffing a response away from the declared Content-Type, blocking content-injection attacks.

Recommended fix

Always set `nosniff`. This is a one-liner with no downsides for correctly-typed responses.

Example header value

X-Content-Type-Options: nosniff

Checked by

SiteReveal SecurityHeaders.io OWASP Mozilla Observatory

Referrer-PolicyRPMedium

Controls how much referrer information is sent with outbound requests. Prevents leaking se…

What it does

Controls how much referrer information is sent with outbound requests. Prevents leaking sensitive URL paths to third-party analytics and ad networks.

Recommended fix

Use `strict-origin-when-cross-origin` as the safe default. This sends the full URL for same-origin requests but only the origin for cross-origin requests.

Example header value

Referrer-Policy: strict-origin-when-cross-origin

Checked by

SiteReveal SecurityHeaders.io Mozilla Observatory

Permissions-PolicyPPMedium

Restricts which browser APIs (camera, microphone, geolocation, payment) the page and its i…

What it does

Restricts which browser APIs (camera, microphone, geolocation, payment) the page and its iframes may access. Reduces the attack surface for malicious third-party scripts.

Recommended fix

Disable all APIs you do not use: `Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()`. Allowlist only what your application genuinely requires.

Example header value

Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()

Checked by

SiteReveal SecurityHeaders.io Mozilla Observatory

Subresource IntegritySRIMedium

Ensures that externally-hosted scripts and stylesheets have not been tampered with by veri…

What it does

Ensures that externally-hosted scripts and stylesheets have not been tampered with by verifying a cryptographic hash before execution.

Recommended fix

Add `integrity` and `crossorigin` attributes to all `<script>` and `<link>` tags that load from CDNs. Generate hashes at srihash.org.

Example header value

Checked by

SiteReveal SecurityHeaders.io OWASP Mozilla Observatory

Cross-Origin-Opener-PolicyCOOPMedium

Isolates the browsing context from cross-origin documents, preventing Spectre-class side-c…

What it does

Isolates the browsing context from cross-origin documents, preventing Spectre-class side-channel attacks that can leak sensitive data from memory.

Recommended fix

Set `same-origin` for maximum isolation. If you use OAuth popups or payment flows that open cross-origin windows, use `same-origin-allow-popups` instead.

Example header value

Cross-Origin-Opener-Policy: same-origin

Checked by

SiteReveal SecurityHeaders.io Mozilla Observatory

HTTPS / TLSTLSCritical

All traffic must be served over HTTPS with a valid TLS certificate. HTTP connections expos…

What it does

All traffic must be served over HTTPS with a valid TLS certificate. HTTP connections expose user data to interception and are penalised by Google in search rankings.

Recommended fix

Use TLS 1.2 or 1.3. Disable TLS 1.0 and 1.1. Use a certificate from a trusted CA (Let's Encrypt is free). Redirect all HTTP to HTTPS with a 301.

Example header value

https://example.com (TLS 1.3, ECDHE_RSA_WITH_AES_256_GCM_SHA384)

Checked by

SiteReveal OWASP Mozilla Observatory

Tool Comparison

SiteReveal vs SecurityHeaders.io vs Mozilla Observatory

All three tools check overlapping sets of security headers. Here is how they compare on coverage, AI insights, and historical tracking.

Tool	Headers checked	Notes
SiteReveal	9	All 9 headers + AI recommendations + score history
SecurityHeaders.io	8	Gold standard for header grading; no AI insights or history
Mozilla Observatory	11	Broader checks including cookies and redirects; no AI
OWASP ZAP	30	Full DAST scanner; requires installation; not a quick check

FAQ

Frequently Asked Questions

What is the most important security header to add first?

Content-Security-Policy (CSP) has the highest impact — it prevents XSS attacks and is worth 20 points. If you can only add one header today, start with CSP. Strict-Transport-Security (HSTS) is the second priority at 15 points.

Does a perfect security score mean my site is unhackable?

No. HTTP security headers are one layer of defence. A perfect security header score means your site correctly implements the browser-level security policies that protect against the most common web attacks (XSS, clickjacking, MIME sniffing, SSL stripping). Application-level vulnerabilities (SQL injection, authentication flaws, insecure APIs) require separate testing with tools like OWASP ZAP or a professional penetration test.

Why does SiteReveal weight security at 25% of the WIS™ score?

Security has the highest weight because it directly affects user trust, legal liability, and search engine ranking. Google's Safe Browsing flags sites with known security issues, and browsers display 'Not Secure' warnings for HTTP sites. A site with excellent performance and SEO but poor security is still a liability for its users and its owner.

How do I check my security score for free?

Use SiteReveal's free Security Check tool at /tools/security-check. Enter any URL and receive a full security header analysis with AI-generated fix recommendations in under 30 seconds. No account required.

Free Security Check

Check your website's security score now

Get a full 9-signal security audit with AI fix recommendations in under 30 seconds. No account required.

← Back to Full Methodology

Website Security ScoreMethodology

Security Score Formula

All 9 Security Signals — Explained

What it does

Recommended fix

Example header value

Checked by

What it does

Recommended fix

Example header value

Checked by

What it does

Recommended fix

Example header value

Checked by

What it does

Recommended fix

Example header value

Checked by

What it does

Recommended fix

Example header value

Checked by

What it does

Recommended fix

Example header value

Checked by

What it does

Recommended fix

Example header value

Checked by

What it does

Recommended fix

Example header value

Checked by

What it does

Recommended fix

Example header value

Checked by

SiteReveal vs SecurityHeaders.io vs Mozilla Observatory

Frequently Asked Questions

Check your website's security score now

Website Security Score
Methodology