security headers checklist Shipped
What this lens looks for
Every web application must set the full set of security response headers: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload; a strict Content-Security-Policy (e.g., default-src 'none'; script-src 'nonce-{random}' 'strict-dynamic'; ...); X-Content-Type-Options: nosniff; X-Frame-Options: DENY; Referrer-Policy: strict-origin-when-cross-origin; Permissions-Policy: camera=(), microphone=(), geolocation=(); and Cache-Control: no-store for sensitive responses.
What its verifier checks
The response sets Strict-Transport-Security with max-age=31536000; includeSubDomains; preload; a strict Content-Security-Policy is present; X-Content-Type-Options: nosniff is set; X-Frame-Options: DENY is set; Referrer-Policy: strict-origin-when-cross-origin is set; Permissions-Policy disables camera, microphone, and geolocation; and sensitive responses set Cache-Control: no-store.