App Security: check your website's security headers
This one is about your website, not your email. Browsers rely on a handful of response headers to protect visitors from clickjacking and content-sniffing attacks. App Security checks whether yours are set.
- Where to find it
- Monitoring & Risk → App Security
What it checks
| Header | What it protects against | Weight |
|---|---|---|
Strict-Transport-Security (HSTS) | Downgrade to unencrypted HTTP | Critical |
Content-Security-Policy | Injected scripts and cross-site scripting | Critical |
X-Frame-Options | Your site being embedded in someone else's page (clickjacking) | Critical |
X-Content-Type-Options | Browsers guessing file types (MIME sniffing) | Critical |
X-XSS-Protection | Legacy XSS filter in older browsers | Standard |
Referrer-Policy | Leaking the pages your visitors came from | Standard |
Permissions-Policy | Unwanted access to camera, microphone, location | Standard |
The score is the percentage of headers present. Click a domain for the detail: each missing header with a suggested value, each present header with its actual value, and the complete raw response for reference.
Who fixes it
Whoever runs your web server or CDN. The suggested values in the detail view can be pasted into most server or CDN configurations as-is. Test Content-Security-Policy carefully; a strict policy can block scripts your site needs.
Still need a hand?
Email support@dmarcs.com, call +971 4 240 4441, or open a ticket from Support inside the app.