Identify. Understand. Remediate.

Both prevent clickjacking, but CSP's frame-ancestors directive is the modern superset - it replaces X-Frame-Options entirely and supports multiple allowed origins, 'self' and 'none'. When both headers are present, browsers following CSP Level 2 use frame-ancestors and ignore X-Frame-Options. Keep X-Frame-Options as a fallback only for legacy user agents.

Only if you are certain every current and future subdomain will support HTTPS indefinitely. Once you are on the Chromium preload list, removal takes weeks to months and ships in every major browser. The safe rollout is: start with max-age=300, confirm nothing breaks, ramp to max-age=63072000; includeSubDomains; preload, then submit at hstspreload.org. The commitment is real - the benefit is real too.

CDNs often terminate TLS and rewrite or strip your origin response headers. Cloudflare, Fastly, Vercel and CloudFront each inject their own edge layer, so a CSP set by your Express or Django app can disappear by the time it reaches the browser. Always verify with curl -I against your public URL, not your origin. If headers are missing, set them at the edge instead of (or in addition to) the origin.

For most sites, shipping HSTS, CSP, X-Content-Type-Options and Referrer-Policy in one change covers the majority of missing headers. Start CSP in Content-Security-Policy-Report-Only mode to catch surprises before enforcing. If your domain also sends mail, add SPF and a DMARC record at p=none as a second pass - it unlocks another grade tier without any risk of blocking legitimate mail.

It tells browsers to evaluate the policy and post violation reports to your report-uri or report-to endpoint without blocking any resource. It is the standard way to roll out CSP on an existing site: ship report-only first, watch the reports for legitimate violations, tighten the policy, and only then switch to the enforcing Content-Security-Policy header. Running both headers simultaneously is allowed and useful during migrations.

No. The scanner reads only what an anonymous browser can see: public HTTP responses, DNS records and TLS metadata. Authenticated pages, internal apps and private staging hosts return no useful signal. For internal or authenticated scans, use a tool like OWASP ZAP or Burp Suite inside your network - WebShield is designed for the public perimeter.