Published 17 October 2026 · General guidance, not a case study or laboratory test.
What a missing security header means
HTTP security headers give a browser instructions about handling a page. For example, a Content Security Policy can limit the resources a page loads. Missing a header is a reason to review the configuration; it does not prove that an attack has happened.
Ask your developer which header was checked, which page returned the result, whether redirects were involved and what the proposed configuration would change. A policy must fit your application. Testing before enforcement can prevent broken payments, forms or embedded content.
Technical reference: OWASP HTTP Headers Cheat Sheet.
Turn the result into a useful developer task
- Record the target and time. Keep the domain, relevant page and date of the scan together.
- Include the actual observation. Share the check title, outcome and returned detail. A grade alone is not enough.
- Ask for the right action. “Please review this configuration and tell me what you recommend changing” is more useful than “make the score perfect.”
- Retest after the change. Keep before-and-after observations and check that important website features still work.
Why a good grade is not a guarantee
An external scan cannot establish whether your administrator accounts have strong access controls, every component is patched, your backups can be restored or your internal devices are secure. An error is not proof of a missing control; an unassessed control is unknown.
Use the result to prioritise a review. For assurance about an important system, agree a wider assessment scope with a qualified provider.