Is only the main URL checked or also sub-pages?

Security headers are checked at the configured website URL. Additional monitored paths verify their availability (uptime, status code, response time), but not their own security headers. Since headers are usually set globally for the whole domain, the main page is sufficient for the header score in almost all cases.

Can I collect CSP violation reports?

Yes. Per site, the website detail → "Security" tab shows the "CSP violation reports" panel with a ready-made token + report-uri to copy. Add to your CSP: `report-uri https://api.xictraq.com/api/csp-report/ `. The endpoint accepts both the classic CSP-2 format (`application/csp-report`) and the modern Reporting-API format (`application/reports+json`). Incoming reports are grouped by directive, blocked source and document URI in the same panel — collection keeps running once you switch to enforce mode too.

How do I move from report-only to enforce mode?

Step 1: set `Content-Security-Policy-Report-Only` with your desired policy + report-uri — the browser blocks nothing but reports every violation to the dashboard. Step 2: watch the incoming reports for 1–2 weeks and iteratively refine the policy via the CSP Wizard (whitelist legitimate sources, intentionally block malicious ones). Step 3: once only noise remains (browser plugins, bots), rename the header to `Content-Security-Policy`. Violations are now actually blocked. Important: the report-uri keeps accepting reports in enforce mode too, so new issues, plugin conflicts or XSS probing show up instantly. You can run both headers in parallel to test an even stricter policy alongside.

How do X-XSS-Protection and CSP differ?

X-XSS-Protection is deprecated and ineffective in modern browsers. CSP is the modern replacement and protects far more comprehensively. XICTRAQ therefore deliberately does not count X-XSS-Protection among the 9 headers.

Is header monitoring tied to a plan?

No. Header scan, score, the CSP wizard and CSP report ingestion are available on every plan. The only difference is the check frequency: Free daily, paid plans every 6 hours — an immediate re-scan is available any time on every plan.

Security headers

HTTP response headers are the most effective protection layer against clickjacking, XSS, mixed content and tracking leaks — and they cost nothing. XICTRAQ checks the 9 most important headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, CORP, COEP), additionally scans CSP for unsafe-inline/unsafe-eval/wildcards, scores the configuration and provides concrete code snippets for nginx, Apache, Caddy, IIS and Node/Express. Continuous monitoring: Free every 24 h, paid every 6 h.

# Header overview

The “Security” tab shows each of the 9 checked headers with status “Active” (green) or “Missing” (red) plus a brief explanation of what it protects against. Above, the overall Security Score (0–100) with its A+/A/B/C/D/F grade.

Website → Security tab

View in demo account →

Security Score

9 HTTP headers + protocol checks

0255075100

Good 78/100

Security Headers

9 critical HTTP security headers

Strict-Transport-Security

Enforces HTTPS and prevents downgrade attacks

Active

Content-Security-Policy

Controls which resources can be loaded (XSS protection)

Active

X-Frame-Options

Prevents clickjacking via iframe embedding

Active

X-Content-Type-Options

Prevents browser MIME type sniffing

Active

Referrer-Policy

Controls what referrer information is sent

Active

Permissions-Policy

Restricts browser APIs like camera, microphone, geolocation

Active

Cross-Origin-Opener-Policy

Isolates the browsing context — protects against tab-napping / Spectre

Active

Cross-Origin-Resource-Policy

Prevents unauthorized cross-origin resource loading

Missing

Cross-Origin-Embedder-Policy

Requires explicit CORP/CORS for embedded resources (Spectre protection)

Missing

# What XICTRAQ checks

HSTS — enforce HTTPS

Strict-Transport-Security: max-age, includeSubDomains, preload directive (detected from the header itself). The header counts as “preload-ready” at max-age ≥ 1 year plus includeSubDomains and preload. Recommendation: max-age=63072000 (2 years), includeSubDomains, preload.

CSP — control content origin

Content-Security-Policy is scanned for common weaknesses: 'unsafe-inline', 'unsafe-eval', overly permissive source lists ('* in script-src'), missing default-src. Concrete hardening example for every finding.

X-Frame-Options / frame-ancestors

Clickjacking protection. Recommendation: SAMEORIGIN, or CSP frame-ancestors 'self'. The Security tab scores X-Frame-Options on its own based on header presence and reports it as missing even when CSP frame-ancestors is set — so set both for a green result.

Referrer-Policy

Controls what is sent as referrer on outbound links. Recommendation: strict-origin-when-cross-origin (browser default); for privacy-sensitive sites: no-referrer.

Permissions-Policy

Restricts browser APIs (camera, microphone, geolocation, USB, MIDI, payment) for the site and 3rd-party iframes. XICTRAQ proposes a default policy for typical marketing sites (everything off that is not needed).

X-Content-Type-Options

nosniff prevents MIME sniffing — critical when user uploads are served. Should be set on every site, zero configuration effort.

Cross-Origin headers (COOP/COEP/CORP)

Strictly isolates your browsing context from other origins — required for SharedArrayBuffer and WebAssembly threading. Optional for classic marketing pages, recommended for web apps. XICTRAQ security-score weighting: COOP 7 pts, CORP 4 pts, COEP is only detected and listed (no score contribution).

Info-leak detection

On top of the 9 headers, XICTRAQ checks for version disclosure: a Server header carrying a version number (e.g. nginx/1.24.0) and any X-Powered-By header are reported as findings. If both are clean (no version, no X-Powered-By), the score earns a bonus.

# How the security score is calculated

The score (0–100) sums fixed points: HTTPS as the base, the points below per present header, plus two bonuses. From that XICTRAQ derives the A+ to F grade. Re-scan and continuous monitoring use the exact same calculation.

# Point allocation (capped at 100)
HTTPS (Basis / base)                 +15
Content-Security-Policy              +20
Strict-Transport-Security (HSTS)     +12
X-Frame-Options                      + 8
X-Content-Type-Options               + 8
Referrer-Policy                      + 8
Permissions-Policy                   + 8
Cross-Origin-Opener-Policy (COOP)    + 7
Cross-Origin-Resource-Policy (CORP)  + 4
Cross-Origin-Embedder-Policy (COEP)  + 0
# Bonuses
HSTS preload-ready                   + 5
no info leaks (server version + X-Powered-By)  + 5

# Grade
A+ from 95   A from 85   B from 70   C from 50   D from 25   F < 25

A CSP set via meta tag still counts

If no Content-Security-Policy is set as an HTTP header, XICTRAQ looks for a Content-Security-Policy meta tag in the HTML and scores it equally (the full 20 points). A Content-Security-Policy-Report-Only header on its own earns no points because it enforces nothing — but its directives still feed the CSP analysis.

# Security Wizard (4 steps)

Instead of hand-crafting headers, the wizard guides you through four steps from scan to reports: 1) scan external sources (CspSourceScanner extracts every host used in scripts/frames/connections), 2) configure headers per directive (hash mode for inline scripts instead of unsafe-inline, token-based report-uri), 3) ready snippet per server (nginx/Apache/Caddy/IIS/Express) to copy, 4) review incoming CSP violation reports in the same panel — grouped by directive, blocked source and document URI.

Generator → nginx

View in demo account →

# Insert into server block
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
add_header Cross-Origin-Opener-Policy "same-origin" always;
add_header Cross-Origin-Embedder-Policy "require-corp" always;
add_header Cross-Origin-Resource-Policy "same-site" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self'; frame-ancestors 'self'; base-uri 'self'; form-action 'self'" always;

After deploying: trigger a re-scan.

Don't roll out CSP blindly

A strict Content-Security-Policy can break your site if a tracker or chat widget gets blocked. Recommended flow: deploy first with Content-Security-Policy-Report-Only, collect reports (XICTRAQ ingests them under your account), only then enforce.

# Weekly security posture in plain language

Once a week, XICTRAQ summarises each active website's security posture from the most recent security scan — the score plus the six core headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) — as a short plain-text paragraph in German and English. This text appears right on the Security Score card in the website detail. By default it is phrased rule-based (free); the AI phrasing is an optional operator toggle.

Frequently asked questions

Free plan: daily. Starter/Business/Agency: every 6 hours. An immediate re-scan can additionally be triggered any time (e.g. after deploying a fix).

# Header overview

Security Score

Security Headers

# What XICTRAQ checks

HSTS — enforce HTTPS

CSP — control content origin

X-Frame-Options / frame-ancestors

Referrer-Policy

Permissions-Policy

X-Content-Type-Options

Cross-Origin headers (COOP/COEP/CORP)

Info-leak detection

# How the security score is calculated

# Security Wizard (4 steps)

# Weekly security posture in plain language

Frequently asked questions

# Related documentation

Let XICTRAQ watch your website.

Let XICTRAQ
watch your website.