TentyWeb basics and security headers
Response headers tell the browser how to treat your site. A few lines add a lot of protection.
What it is
The check covers Strict-Transport-Security (HSTS), Content-Security-Policy, frame protection, X-Content-Type-Options, Permissions-Policy and Referrer-Policy, plus headers that name your framework or server version.
Why it matters
HSTS keeps visitors on https. A content security policy limits which scripts may run if someone injects one. Frame protection stops another site from loading yours in a hidden frame. Headers that name the framework or server version save attackers the guessing. These findings are low or informational and add up to a safer default.
How Tenty checks it
Tenty reads the headers of your page and its scripts on every scan.
How to fix it
Add the headers at your host. Examples:
- Vercel: add them under
headersinvercel.json. - Netlify: add them in
netlify.tomlunder[[headers]]or in a_headersfile. - Cloudflare: add them with a Transform Rule or a
_headersfile on Pages.
Starting values: Strict-Transport-Security: max-age=31536000; includeSubDomains, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, Permissions-Policy: camera=(), microphone=(), geolocation=() and a Content-Security-Policy that lists your script sources.
How to reproduce
curl -sSI 'https://YOUR-APP/'The answer lists the headers. Compare it with the finding.