Can security headers break my website?

Most cannot. Content-Security-Policy can, if it blocks scripts you need. Start with Content-Security-Policy-Report-Only to see what would be blocked.

Is X-XSS-Protection still needed?

No. Modern browsers have removed that filter. Use a Content-Security-Policy instead.

Why does the scan only look at the homepage?

Headers are usually set for the whole site at once. The scan is passive on purpose: one visit, no crawling.

Security headers check

Test which HTTP security headers a website sends and get an A–F grade with the exact header to add. HTTPS, cookies and visible software versions are checked in the same scan.

Which headers matter

Strict-Transport-Security (HSTS): browsers only use HTTPS for your site, even if someone types http://.

Content-Security-Policy (CSP): which scripts, styles and frames the page may load. The best defence against cross-site scripting.

X-Frame-Options or CSP frame-ancestors: stops other sites from showing yours in a hidden frame (clickjacking).

X-Content-Type-Options: nosniff, so browsers don’t guess file types.

Referrer-Policy and Permissions-Policy: what your site shares with other sites and which browser features it may use.

Example for nginx

Add these lines to the server block of your site and reload nginx. Build the Content-Security-Policy step by step, because a too-strict policy can break scripts.

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

add_header X-Content-Type-Options "nosniff" always;

add_header X-Frame-Options "SAMEORIGIN" always;

add_header Referrer-Policy "strict-origin-when-cross-origin" always;

add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

Apache, IIS, Cloudflare and hosting panels

Apache uses “Header always set” in .htaccess or the virtual host, IIS uses customHeaders in web.config, and Cloudflare uses Transform Rules. On managed hosting, send the report link to your provider: every finding names the exact header.

Questions

Can security headers break my website?: Most cannot. Content-Security-Policy can, if it blocks scripts you need. Start with Content-Security-Policy-Report-Only to see what would be blocked.
Is X-XSS-Protection still needed?: No. Modern browsers have removed that filter. Use a Content-Security-Policy instead.
Why does the scan only look at the homepage?: Headers are usually set for the whole site at once. The scan is passive on purpose: one visit, no crawling.

OZAG Technologies · KVK 42167370 · Laan van Oversteen 20, 2289 CX Rijswijk · +31 6 24496620 · support@ozagsecurity.com