H3-2026-0068¶
Missing HTTP Security Response Headers
| Category | SECURITY_MISCONFIGURATION |
| Base Score | 0.1 |
Description¶
A web application returned responses that omitted one or more recommended HTTP security headers, such as Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options (or a CSP frame-ancestors directive), Referrer-Policy, or Permissions-Policy.
Impact¶
Missing security headers weaken the browser-side defenses that harden an application against clickjacking, MIME-type sniffing, protocol downgrade, and referrer leakage. They do not constitute an exploitable weakness on their own, but they lower the bar for other client-side attacks, such as cross-site scripting.