What a security header actually does
A header is a line your server sends with every page, before the page itself. Some of those lines are instructions to the browser about how to treat what follows: which sources of code to trust, whether to allow the page inside a frame, whether to insist on an encrypted connection next time. The browser obeys them. Without them it falls back to permissive defaults that exist for compatibility with the web of fifteen years ago.
The headers this check reads
Five carry most of the value. The rest are worth having but rarely change an outcome on a small-business site.
- Strict-Transport-Security: makes HTTPS mandatory for future visits
- Content-Security-Policy: limits which code the browser will run
- X-Content-Type-Options: stops the browser guessing what a file really is
- frame-ancestors: stops other sites embedding yours invisibly
- Referrer-Policy: controls how much of your URL leaks to sites you link to
Where people get Content-Security-Policy wrong
A policy that allows inline scripts is the common failure. It looks like a policy, it scores as a policy on most checkers, and it permits exactly the thing a policy exists to block. Start in report-only mode, read the reports for a week, then enforce. SiteGuardia reports an inline-permitting policy separately from a missing one, because the fix is different.