My security scanner says my site is missing security headers
Free website scanners, and the Security Insights page in Cloudflare, check for a few security headers. A header is a short note that a website sends to the browser with each page. You never see it, but it tells the browser how careful to be.
The prompt
“My security scanner says [my web address] is missing [the header it names]. Tell me what that setting does and whether I need to do anything.”
Signed in, Get my prompt fills in your site for you. Otherwise press Copy and fill in the [bracketed] parts. First time? Connect your AI to bernard once: Use your own AI (opens in a new tab).
What bernard adds to every site
You do not need to do anything. bernard adds these on every site it hosts:
- Always use the secure address (scanners call it HSTS). It tells a visitor’s browser to open your site on the secure address, the one with the padlock, even if someone types the plain address. bernard starts with a short time and makes it longer later, so a mistake can always be put right.
- Treat each file as what it says it is (scanners call it nosniff). It stops a browser from guessing that a file is a program when it is not, which is a trick attackers use.
- Share only your web address when a visitor leaves (scanners call it a referrer policy). When a visitor clicks a link to another site, that site sees your web address but not the exact page the visitor came from.
- No storage details. bernard keeps your files in secure storage, and that storage adds notes to each file about how it is kept. They are no use to a visitor and could help an attacker, so bernard removes them before your page reaches the browser.
These settings do not change how your site looks or works for your visitors.
What bernard does not add yet
Two settings that some scanners ask for are not on yet:
- Stop other sites showing your pages inside theirs. Your own preview and comment mode show your pages inside bernard, so this setting must be tested carefully first.
- Turn off features a page does not use, such as the camera and microphone. Videos you embed from other sites can need some of these features, so this is being tested too.
Two older settings that scanners sometimes list are no longer used by browsers, so bernard leaves them out on purpose.
When a scanner still says something is missing
You usually do not need to change anything on your site. The scanner most likely tested an address that does not reach bernard, such as the plain version of your domain without www, which your own domain settings send on to your site. Run the scanner again on the address your visitors land on.
bernard also puts a security contact file on every site. If a scanner says that file is missing, see My security scanner says security.txt is missing. For more about how bernard keeps your site safe, see Is it safe to let an AI edit my site?.
Questions people ask
- Do I need to do anything?
- No. bernard adds these settings to every site it hosts, on your bernard address and on your own domain. There is nothing to write, nothing to approve and nothing to publish.
- Can I change these settings or add my own?
- No. They are the same for every site bernard hosts, because they belong to the hosting, not to your pages. Changes to your pages still wait for your approval as usual; these settings sit around the pages and do not change what your visitors see.
- My scanner still says something is missing. What now?
- First check which address the scanner tested. If it tested the plain version of your domain without www, your own domain settings usually send that on before it reaches bernard, so the scanner never sees bernard’s settings. Run it again on the address your visitors land on, or ask Bernard to check it.
- My scanner says I have no setting that stops other sites showing my pages inside theirs. Why not?
- bernard does not add that one yet. Your own preview and comment mode show your pages inside bernard, and the setting must not break them. bernard is testing it first and will add it to every site when it is safe.