Check status and redirects first
A missing or unexpected header can belong to a redirect response instead of the final page. Confirm status and redirect chain before interpreting header findings.
Website triage
Security headers triage
Security-header checks are useful launch signals, but they are not a full security audit. Results can vary by URL, redirect path, CDN, environment, and deployment timing.
Details
What to know
Headers are policy signals
Security headers such as HSTS, CSP, X-Frame-Options, content-type, and referrer policy describe browser-facing behavior. They do not prove the application is vulnerability-free.
SSL and DNS are adjacent checks
Certificate, host, DNS, and IP signals help explain why a site behaves differently across environments. Run them as supporting checks, not substitutes for application review.
Document findings as triage
Use Convurter reports to route issues to hosting, DNS, CDN, app, or security owners. Treat the report as a point-in-time diagnostic, not a compliance artifact.
Related tools