Corporate vendor reviews typically check for six response headers: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy. Missing headers are visible to anyone without special access, which means a procurement officer can disqualify a supplier before any conversation, and usually without telling them why.
Last updated 25 July 2026
Security headers are instructions a server sends to the browser before any content loads. They are checkable by anyone, from anywhere, in seconds, without permission. That makes them a free pre-qualification signal — a buyer can grade your posture without asking and without telling you the result.
The asymmetry worth noticing is that this check is silent in both directions. You cannot see who ran it, and they have no reason to tell you the outcome.
A vendor review checks six response headers. Strict-Transport-Security forces HTTPS. Content-Security-Policy restricts what can execute. X-Content-Type-Options stops MIME sniffing. X-Frame-Options prevents clickjacking. Referrer-Policy limits URL leakage. Permissions-Policy disables unused browser APIs. Together they form the baseline an automated scan grades against, and all six are server configuration rather than application code.
A seventh, Cross-Origin-Resource-Policy, appears in stricter reviews but is not yet standard in most supplier checklists.
HSTS closes the unencrypted first request that session-downgrade attacks rely on. CSP is the one that turns a minor injection into a contained event rather than a data breach. The other four each remove a specific, well-understood class of attack, and all six are configuration rather than code.
Because these are response headers rather than application logic, they can be added to an existing site without touching its code — which is why the cost-to-benefit ratio here is unusually favourable.
Request your domain and read the response headers, or run it through a public scanner such as Mozilla Observatory. You will get a grade and a list of what is missing. No access or credentials are required — which is precisely why buyers can do it too.
Run it against a competitor while you are there. In most categories the results explain a good deal about who is being shortlisted.
It signals unmanaged infrastructure rather than active negligence, but the distinction rarely survives a filtering step. A failing grade does not usually produce a remediation conversation. It produces a quiet removal from the list, and no notification that it happened.
In regulated sectors the scan often runs before a human reads the proposal at all, which inverts the usual assumption that credentials get evaluated first.
For a static site or a modern host, adding all six is a configuration file and a deployment — typically under an hour, with F-to-A in a single release. The main care needed is with Content-Security-Policy, which must name the third-party domains you actually use or it will block them.
The security header reference on this site lists each header, what it prevents, and a copy-paste configuration.
Open the header reference →