Security Header Reference

The vendor review you're failing without knowing it.

Run time ~5 min to scan, ~1 hour to correct · Requires access to your hosting configuration · Free, no forms

Why this matters beyond hardening

Security headers are instructions your server sends to browsers before a single word of content loads. They are trivially checkable by anyone, from anywhere, in seconds, without permission.

That last point is the one businesses miss. A prospect, a competitor, a procurement officer, or an auditor can grade your security posture without asking and without telling you.

The distribution consequence: enterprise and institutional buyers increasingly run an automated scan as a pre-qualification step. It costs them nothing. A failing grade doesn't produce a conversation about remediation — it produces a quiet removal from the vendor list.

You will never receive that email. That's the entire problem.

Run the scan first

Scan your domain at Mozilla Observatory (developer.mozilla.org/observatory). Note your grade before reading further. Most Panamanian business sites score F.

If you scored F, nothing is wrong with your business. Your server was simply never configured to say anything — and defaults are silence.

The headers

Strict-Transport-Security (HSTS)

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Forces browsers to use HTTPS exclusively for one year, including subdomains.

Without it: A browser will attempt an unencrypted connection first. On untrusted networks — hotel wifi, airport, café — that initial request is interceptable. Session-downgrade attacks depend on this gap.

Content-Security-Policy (CSP)

Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; object-src 'none'; base-uri 'self'; form-action 'self'

Declares which sources may load scripts, styles, images, and other resources.

Without it: Any injected script executes with full page access — including access to your form fields. This is the header that turns a minor vulnerability into a data breach.

Note: Add your actual third-party domains to the relevant directives. Analytics, payment processors, and font providers each need explicit permission.

X-Frame-Options

X-Frame-Options: DENY

Prevents your site from being embedded in a frame on another domain.

Without it: Clickjacking. Your site rendered invisibly over an attacker's page, so users interact with your interface while believing they're somewhere else.

X-Content-Type-Options

X-Content-Type-Options: nosniff

Stops browsers from guessing file types.

Without it: An uploaded file the server labels as an image may be interpreted and executed as a script.

Referrer-Policy

Referrer-Policy: strict-origin-when-cross-origin

Controls how much URL information travels with outbound links.

Without it: Full URLs — including any parameters — leak to every external site your users visit from yours. This is also a Ley 81 exposure if those URLs carry personal data.

Permissions-Policy

Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()

Disables browser APIs your site doesn't use.

Without it: Any script on your page can request camera, microphone, or location access. Remove payment=() if you use a payment processor requiring the Payment Request API.

Implementation

Cloudflare Pages — create a file named _headers in your site root:

/*
  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
  X-Content-Type-Options: nosniff
  X-Frame-Options: DENY
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()
  Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; object-src 'none'; base-uri 'self'; form-action 'self'

Other platforms use different mechanisms — Netlify uses the same _headers format, Apache uses .htaccess, nginx uses the server block. The header values are identical regardless.

Verify by rescanning. F to A is typically a single deployment.

Which do you have?

Six headers, pass or fail. Tick the ones your scan already returns — there is no score here, only a gap list. Every unticked row is a one-line addition to your _headers file.

What visibility this unlocks

• Passing automated pre-qualification at institutional buyers who scan before they shortlist
• Surviving vendor security questionnaires without a remediation delay that costs you the timeline
• Credibility with technical buyers — CTOs, IT directors, and security-conscious executives check, and they check first
• Ley 81 evidence — four of these headers directly evidence Seguridad, Integridad, and Confidencialidad

The asymmetry: this costs one afternoon and permanently removes a silent disqualifier. Most of your competitors are scoring F right now and have no idea, because failure in this channel is invisible from the inside.