Skip to content

Security

Which baseline security headers should I set

These are one-line headers with no downside. `nosniff` stops a browser guessing that an uploaded file is executable script; `Referrer-Policy` keeps your internal URLs and query parameters out of other sites' analytics; frame protection stops your pages being embedded in someone else's clickjacking overlay.

What 13x checks

This is rule security.headers in the public registry: Baseline security headers. It runs on every audit, against the pages we actually fetched, and its result is derived from the response rather than estimated.

Surface
Security
Score weight
6 of the readiness score
Scope
Runs on every audited page
Applies
To every site

Registry version 2026-07-30. Every rule is published, and the audit is deterministic — the same page produces the same finding every time.

The fix

The same text the audit hands you when this check fails on your own site.

Missing: . These are one-line headers with no downside:

Configuration
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
X-Frame-Options: DENY
Permissions-Policy: camera=(), microphone=(), geolocation=()

What each one buys:

- nosniff stops a browser deciding that a file you serve as text is really executable script — the classic upload-based XSS. - Referrer-Policy keeps your internal URLs and query parameters out of other sites' analytics when someone clicks an outbound link. - X-Frame-Options stops your pages being embedded in a clickjacking overlay. Use SAMEORIGIN if you legitimately iframe yourself. - Permissions-Policy denies APIs you do not use, so an injected script cannot ask for the camera.

Framework-specific versions

Where the change differs enough to be worth writing out separately.

Does your site have this problem?

13x checks this and 112 others against your live URL in about 30 seconds. No account, and every finding comes with the fix for your framework.

No signup. Results in 30 seconds.

More security checks