What is it?
This HTTP finding means one or more recommended browser security headers are absent. It may refer to headers such as HSTS, CSP, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, or frame protection.
Why does it matter?
Security headers do not replace application security, but they give browsers clear instructions that reduce common risks: downgrade attacks, content injection impact, MIME sniffing, clickjacking, overbroad feature access, and referrer leakage.
How to fix it?
Add a baseline set of headers at the CDN, reverse proxy, or application server.
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Security-Policy: default-src 'self'; frame-ancestors 'self'
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()Roll out strict CSP and HSTS carefully. Test real user flows before enforcing policies that can block scripts, embeds, or subdomains.