HTTP Security Headers, HSTS & CSP Policy Inspector
Audit live HTTP response headers for Strict-Transport-Security (HSTS), Content-Security-Policy (enforced vs Report-Only), X-Frame-Options, Referrer-Policy, and Permissions-Policy.
Why Enforced Security Headers Matter for E-Commerce & Enterprise Sites
Many platforms (including default Magento 2 installations) ship with Content-Security-Policy in Report-Only mode, which logs violations without blocking malicious script injection. SEORankPro inspects raw response headers and distinguishes between enforced policies and Report-Only configurations.
- Verifies HSTS max-age, includeSubDomains, and preload readiness against SSL stripping
- Distinguishes enforced Content-Security-Policy headers from Report-Only mode
- Checks X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and SSL certificate expiry