¿Qué es el puntaje de seguridad de cabeceras?

Es una calificación de 0 a 100 (y una letra de A+ a F) calculada a partir de si tu sitio tiene configuradas correctamente seis cabeceras de seguridad clave: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy y Permissions-Policy.

¿Por qué es un problema que el servidor revele su versión?

Cabeceras como Server o X-Powered-By le dicen a un atacante exactamente qué software y versión corre tu servidor, lo que le ahorra tiempo buscando exploits ya conocidos para esa versión específica.

¿Cómo aplico las cabeceras que me recomienda la herramienta?

Cada cabecera con un botón 'Cómo solucionarlo' incluye el fragmento de código exacto para Nginx, Apache, Node/Express (con Helmet), Cloudflare y Vercel/Next.js, listo para copiar y pegar.

Web Security & HTTP Diagnostics

Auditor of HTTP Headers & Security

Security score, information leaks, caching and redirect chain for any site, with copy-ready fixes.

HTTP Headers Architecture & Web Hardening

Defense-in-depth against XSS, Clickjacking, MIME sniffing, and information disclosure.

Content-Security-Policy & XSS Protection

CSP establishes strict whitelists of trusted domains for scripts, styles, and assets, acting as the primary defense against Cross-Site Scripting (XSS).

HSTS & Preload Lists

HSTS forces browsers to strictly use HTTPS encrypted connections, preventing SSL-stripping and MITM downgrade attacks.

Clickjacking & Framing Restrictions

Prevents invisible iframe embedding on third-party sites using `X-Frame-Options: SAMEORIGIN` or CSP `frame-ancestors 'self'`.

Cache-Control & Version Masking

Directives like `Cache-Control: private` safeguard user data while hiding `Server` and `X-Powered-By` denies automated vulnerability fingerprinting.

HTTP Headers & Security Policy Troubleshooting

Step-by-step fixes for CORS errors, CSP blocking, HSTS lockouts, and aggressive caching.

Issue 1

CORS Policy Failure: Missing Access-Control-Allow-Origin

⚡ Quick Fix:Use the `cors` middleware in Express (`app.use(cors({ origin: 'https://mydomain.com' }))`) to whitelist client domains.

🔧 Technical Fix:Configure Nginx `add_header 'Access-Control-Allow-Origin' '$http_origin' always;` and handle OPTIONS preflight with 204 No Content.

Issue 2

Scripts or Styles Blocked by Strict CSP Directive

⚡ Quick Fix:Inspect browser console (F12) to identify blocked domains and add them to `script-src` or `style-src`.

🔧 Technical Fix:Implement cryptographic SHA-256 hashes or server-generated nonces instead of permitting `'unsafe-inline'`.

Issue 3

HSTS Breaks Local Development or Staging Subdomains

⚡ Quick Fix:Visit `chrome://net-internals/#hsts` and delete the domain under 'Delete domain security policies'.

🔧 Technical Fix:Omit `includeSubDomains` from production HSTS until all staging subdomains possess valid SSL certificates.

Issue 4

Aggressive Caching Preventing Users from Seeing Code Updates

⚡ Quick Fix:Serve HTML entrypoints with `Cache-Control: no-cache, no-store, must-revalidate` for immediate revalidation.

🔧 Technical Fix:Pair content-hashed asset filenames (e.g. `main.[hash].js`) with `Cache-Control: max-age=31536000, immutable`.

Did You Know? HTTP Protocol Trivia

The 'Referer' misspelling legacy, HTTP 418 Teapot, and the Terry Pratchett Clacks header.

✍️

The Permanent 'Referer' Misspelling in RFC 1945

In 1996, authors of RFC 1945 accidentally misspelled 'Referrer' as 'Referer'. Correcting it would break existing web systems, cementing the typo forever.

☕

HTTP Status 418: 'I'm a Teapot'

Published in RFC 2324 as an April Fools joke for hyper text coffee pots, HTTP 418 refuses to brew coffee because it's a teapot. Many servers still implement it as an easter egg.

📡

X-Clacks-Overhead: The Terry Pratchett Tribute

Thousands of servers send `X-Clacks-Overhead: GNU Terry Pratchett`. In Discworld lore, a person's name never dies as long as it's echoed across the transmission lines.

🕵️

Server Fingerprinting & Security Through Obscurity

Default server headers advertise software and OS versions. Suppressing them stops 90% of automated port-scanning bots looking for version-targeted exploits.