How to fix it

81 findings. Pick the one in front of you. Each page has the config for your stack.

Security headers 11

Add a Content-Security-Policy header headers-csp A Content-Security-Policy tells the browser which scripts it is allowed to run, so markup an attacker manages to inject never executes.
Add a Permissions-Policy header headers-permissions Permissions-Policy controls which browser features a page and its iframes may use, so camera, microphone and geolocation stay off by default.
Add an HSTS header headers-hsts Without Strict-Transport-Security a browser still tries plain HTTP first, and one intercepted request is enough to steal a session cookie.
Add integrity hashes to CDN scripts content-sri A script loaded from a CDN runs with your privileges. An integrity hash makes the browser refuse it if the file ever changes underneath you.
Add the X-Content-Type-Options header headers-xcto Browsers guess the type of a response when the server does not say. Sending nosniff stops an uploaded file being run as script.
Block your pages from being framed headers-xfo With no frame-ancestors or X-Frame-Options rule your pages load invisibly inside another site, and clicks land on actions you own.
Fix mixed content on an HTTPS page content-mixed An HTTPS page that pulls scripts or images over plain HTTP gives an attacker on the network a way in. Serve every subresource over HTTPS.
Hide your server version header headers-server-version The Server header names your web server and its exact version, so anyone can look up published CVEs for it. Serve the product name only.
Remove the X-Powered-By header headers-xpb The X-Powered-By header announces your framework and its version, which hands an attacker the shortlist of exploits to try first. Remove it.
Set a Referrer-Policy header headers-referrer The Referer header sends your full URL to every site you link out to. A Referrer-Policy trims it so tokens and IDs in the path do not leak.
Stop a state-changing form being framed clickjacking-form A form on this page changes state and the page can be framed, so a visitor clicking something harmless elsewhere submits it. Deny framing.

HTTPS and certificates 7

DNS and email 16

Exposed files and endpoints 25

Cross-origin and header injection 12

Sessions and access control 10

Not sure which of these you have?

A scan names the ones that are live on your app.