Add the missing security headers

Problem

The crawled response is missing one or more standard security headers. The crawler stores what it saw in the security sub-document; anything absent there is reported here.

Why it matters

• Strict-Transport-Security (HSTS) — without it, the first request can be downgraded to HTTP (SSL stripping).
• Content-Security-Policy (CSP) — the main defense against XSS and injected scripts.
• X-Content-Type-Options: nosniff — stops browsers from MIME-sniffing responses into executable types.
• X-Frame-Options — prevents clickjacking via hidden iframes.
• Referrer-Policy — keeps full URLs (tokens, IDs) out of third-party referrer logs.
• Permissions-Policy — disables powerful APIs (camera, geolocation) the site does not use.

How to fix

Set the headers at the web server or CDN level, then re-crawl to verify:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header Content-Security-Policy "default-src 'self'" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

Start with report-only CSP (Content-Security-Policy-Report-Only) on complex sites, then enforce.