All questions
Q & A Security · September 11, 2026

How do I test my security headers without breaking production?

Three options: (1) Report-Only variants — Content-Security-Policy-Report-Only, Cross-Origin-Opener-Policy-Report-Only — send violation reports without blocking. (2) Roll out per-endpoint — test on a low-traffic route first. (3) Use our security headers checker to inspect current state before and after deployment. Never ship a new CSP straight to production without a Report-Only bake period.

Read the full guide
HTTP Security Headers Explained: HSTS, CSP, X-Frame-Options, and the Rest
HTTP security headers are the browser-enforced defence layer that runs before your application code. Deployed correctly, they eliminate whole classes of attacks — even when the underlying application has bugs. Deployed incorrectly, they silently break the site.
Related questions
Do I need HTTPS to use security headers? What does an open port mean for security? What is the difference between X-Frame-Options and CSP frame-ancestors? Which security headers should every site set? Will CSP break my site?