These checks inspect headers in the web responses collected during the scan. They help identify missing or weak browser-side controls, but they do not execute your application or establish whether a specific attack succeeds.
Content Security Policy
CSP tells a browser which content sources and behaviors a page permits. SSLBoard recognizes findings for a missing enforced policy, an empty policy, a policy that is only report-only, inline-script allowance, eval-style script allowance, and wildcard script sources.
A report-only policy can help you prepare a rollout, but does not enforce its restrictions. An observed warning is a reason to review the actual directives, nonces or hashes, and application requirements. The scan does not prove that the policy is ineffective against every attack or that a missing policy means the application contains an injection vulnerability.
Frame protection and nosniff
Frame protection findings cover missing protection, invalid X-Frame-Options, and its obsolete ALLOW-FROM value. An enforced CSP frame-ancestors directive can also supply frame protection. Decide which embedding relationships the application actually needs before restricting them.
The nosniff check reports missing X-Content-Type-Options or a value other than nosniff. Review response content types as well as the header; a header alone cannot repair incorrectly served application content.
Cookie findings
| Finding | What to review |
|---|---|
| Missing Secure | Whether the cookie should be restricted to secure connections. |
| Missing HttpOnly | Whether browser scripts really need access to that cookie. |
| Missing SameSite | The intended cross-site behavior, including sign-in and embedded flows. |
| SameSite=None without Secure | The combination of cross-site intent and secure transport requirements. |
| Invalid __Secure- prefix | Whether the cookie meets the prefix’s secure-setting requirements. |
| Invalid __Host- prefix | Whether the cookie meets the host-prefix restrictions, including Secure, path, and domain scope. |
| Partitioned without Secure | Whether a partitioned cookie has its required secure attribute. |
| Unparseable Set-Cookie | The syntax of the returned cookie header. |
These warnings need application context. Some cookies deliberately need JavaScript access, while session cookies often have different requirements. A response that sets no cookies does not assess cookies created later during sign-in.
Other policy findings
The report also recognizes Referrer-Policy values of unsafe-url or invalid values; empty or invalid Permissions-Policy; and invalid Cross-Origin-Resource-Policy, Cross-Origin-Embedder-Policy, and Cross-Origin-Opener-Policy values. These are informational findings in the current model.
Do not apply the strictest possible value to every service without checking behavior. Cross-origin and permissions controls can affect legitimate embedding, media, authentication, and third-party resources.
Verify changes
Apply the intended policy where the public response is produced, then retest and inspect the observed headers. Exercise important application flows separately, including sign-in and embedded content. SSLBoard samples responses rather than auditing every route or authenticated session.
See HSTS for HTTPS persistence policy and result states when no header evidence is available.
For the browser semantics behind these checks, see the CSP reference and Set-Cookie reference.