Seguridad

Security headers

Checks for HSTS, CSP, X-Frame-Options and other security headers.

Comprobar su sitio gratis

¿Por qué importa esto?

Security headers protect visitors from common attacks like XSS, clickjacking and man-in-the-middle. Google prefers secure sites and poor security can damage visitor trust.

¿Cómo se soluciona?

Add the following headers to your server responses: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy. Test via securityheaders.com.

Este check puntúa de 0 a 100. Bajo 50 es un fallo, 50 a 89 un aviso, 90 o más es bueno. Tras cada crawl ve la nota por página en el informe, con una breve explicación.

Preguntas frecuentes

Checks for HSTS, CSP, X-Frame-Options and other security headers.

Security headers protect visitors from common attacks like XSS, clickjacking and man-in-the-middle. Google prefers secure sites and poor security can damage visitor trust.

Add the following headers to your server responses: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy. Test via securityheaders.com.

Ejemplo

Copie el código de abajo y adapte el dominio, la marca y el contenido a su situación. 

# Nginx: security headers
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;

# Apache .htaccess
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"
Header always set X-Frame-Options "DENY"
Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "strict-origin-when-cross-origin"

# Validate via: https://securityheaders.com
Mixed content
Empezar gratis