Sicherheit

Security headers

Checks for HSTS, CSP, X-Frame-Options and other security headers.

Website kostenlos prüfen

Warum ist das wichtig?

Security headers protect visitors from common attacks like XSS, clickjacking and man-in-the-middle. Google prefers secure sites and poor security can damage visitor trust.

Wie beheben Sie es?

Add the following headers to your server responses: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy. Test via securityheaders.com.

Dieser Check bewertet von 0 bis 100. Unter 50 ist ein Fail, 50 bis 89 eine Warnung, 90 oder höher ist gut. Nach jedem Crawl sehen Sie die Note pro Seite im Report, mit einer kurzen Erklärung.

Häufige Fragen

Checks for HSTS, CSP, X-Frame-Options and other security headers.

Security headers protect visitors from common attacks like XSS, clickjacking and man-in-the-middle. Google prefers secure sites and poor security can damage visitor trust.

Add the following headers to your server responses: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy. Test via securityheaders.com.

Beispiel

Kopieren Sie den Code unten und passen Sie Domain, Markenname und Inhalt an Ihre Situation an. 

# Nginx: security headers
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;

# Apache .htaccess
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set X-Frame-Options "DENY"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"

# Validate via: https://securityheaders.com
Mixed content
Kostenlos starten