Security (OWASP) issues we check — and how to fix them
A missing security header exposes your customers, and a compromised or flagged site loses search visibility fast. We check the server configuration, HTTPS setup, and email authentication issues that erode trust — before they become an incident.
26 catalogued Security (OWASP) issues, each with step-by-step, platform-specific fixes.
- Dmarc policy noneModerate effortStrengthen your DMARC policy from p=none (monitor-only) to p=quarantine, then p=reject, so that emails fraudulently sent from your domain are blocked rather than silently allowed through.
- Hsts disabledQuick winSet a valid HTTP Strict-Transport-Security (HSTS) header with a max-age of at least 31536000 (one year) and includeSubDomains to force browsers to always use HTTPS for your store.
- Hsts max age too shortQuick winIncrease your HSTS max-age directive to at least 31536000 seconds (1 year) so browsers enforce HTTPS connections for a meaningful period.
- Https not availableQuick winEnable HTTPS by installing a valid SSL/TLS certificate and redirecting all HTTP traffic to the secure HTTPS version of your store.
- Info disclosure serverQuick winRemove or suppress the HTTP `Server` response header so your web server no longer advertises its software name and version number to the public internet.
- Info disclosure x powered byQuick winRemove or suppress the X-Powered-By HTTP response header so your server stops advertising which technology stack, hosting platform, or software version powers your store.
- Insecure cookieModerate effortSet the HttpOnly, Secure, and SameSite flags on all session and authentication cookies to prevent them from being stolen or misused by attackers.
- Missing content security policyModerate effortAdd a Content-Security-Policy (CSP) HTTP response header to every page to block unauthorized scripts, styles, and resources from loading in your visitors' browsers.
- Missing dmarcQuick winAdd a DMARC DNS TXT record at _dmarc.yourdomain.com to tell receiving mail servers how to handle emails that fail authentication checks for your domain.
- Missing permissions policyQuick winAdd a Permissions-Policy HTTP response header to your store to explicitly restrict which browser features (camera, microphone, geolocation, etc.) pages and embedded third-party scripts are allowed to access.
- Missing referrer policyQuick winAdd a Referrer-Policy HTTP response header set to strict-origin-when-cross-origin to control what URL information browsers send when users navigate away from your store.
- Missing security txtQuick winCreate and publish a /.well-known/security.txt file with at least a Contact: line so security researchers know how to report vulnerabilities responsibly.
- Missing spfQuick winAdd a DNS TXT record containing a valid SPF policy to your domain so that email receivers can verify which servers are authorised to send mail on your behalf.
- Missing strict transport securityQuick winAdd the Strict-Transport-Security (HSTS) response header to every HTTPS page so browsers always use an encrypted connection to your store.
- Missing x content type optionsQuick winAdd the `X-Content-Type-Options: nosniff` HTTP response header to every page and asset your store serves.
- Missing x frame optionsQuick winAdd the X-Frame-Options HTTP response header set to DENY or SAMEORIGIN to prevent your store's pages from being embedded in iframes on other sites.
- Passive scan onlyModerate effortSet up regular active security testing (DAST) on a staging copy of your store to catch vulnerabilities that passive header/cookie/TLS scans cannot find.
- Ssl cert expiring soonQuick winRenew your SSL/TLS certificate before it expires to keep your store secure, trusted, and visible in search results.
- Ssl cert invalidModerate effortInstall a valid SSL/TLS certificate that exactly matches your store's domain name, so browsers trust your site and customer data is encrypted in transit.
- Ssl errorModerate effortReplace or reissue your SSL/TLS certificate so it is valid for the exact domain name your store uses, eliminating the hostname mismatch error.
- Ssl not accessibleModerate effortEnable HTTPS on your store by opening port 443 and installing a valid SSL/TLS certificate so every page is served over a secure connection.
- Vulnerable component axiosModerate effortUpdate the Axios JavaScript library to its latest stable release to eliminate known security vulnerabilities in your storefront code.
- Vulnerable component jqueryModerate effortUpdate jQuery to the latest stable version (3.7+) to eliminate known cross-site scripting (XSS) and prototype-pollution vulnerabilities that attackers actively exploit.
- Weak spfQuick winAdd a hard-fail (-all) or soft-fail (~all) terminator to your SPF DNS record so that mail servers reject or flag email sent from servers not explicitly authorized by your domain.
- X content type options weakQuick winSet the X-Content-Type-Options response header to exactly `nosniff` (once, not duplicated) on every page and asset your store serves.
- X frame options weakQuick winReplace the weak X-Frame-Options header value with DENY or SAMEORIGIN to prevent clickjacking attacks on your store.
Security (OWASP) — common questions
What security headers should ecommerce stores have?+−
The critical headers are: Content-Security-Policy (CSP) to prevent XSS and Magecart payment skimmer attacks, Strict-Transport-Security (HSTS) to enforce HTTPS, X-Frame-Options or a frame-ancestors CSP directive to prevent clickjacking, Permissions-Policy to limit browser feature access, and X-Content-Type-Options to prevent MIME sniffing.
What are SPF and DMARC and why do ecommerce stores need them?+−
SPF and DMARC are DNS records that authenticate email sent from your domain and prevent spoofing. Without them, anyone can send phishing emails appearing to come from your store. Google and Yahoo's 2024 sender requirements also make DMARC effectively mandatory for bulk senders — stores without it risk transactional email being filtered to spam.
What is a Content Security Policy and why is it hard to implement on ecommerce sites?+−
A Content Security Policy (CSP) tells the browser which sources it's allowed to load scripts, styles, and other resources from. On ecommerce sites, the app ecosystem (chat widgets, analytics, payment processors, review tools) loads scripts from many external sources that all need to be explicitly allowed — making CSP complex to implement correctly, which is why it's often missing or set to report-only mode.