Hosting, Proxy and Application Configuration
Check web servers, upstream cache and application as separate output layers. A header change must also be visible for cached answers.
Response headers can be created in the web server, reverse proxy or in Commerce extensions. Check the publicly visible combination, especially if Varnish or a CDN is upstream.
Where to check the setting in Magento
Check the headers of the final HTTPS response and the jurisdiction of the application, web server, and CDN. In the case of CSP rules, additional checkout and payment integrations must be tested. A general blocking rule from another shop is not a secure standard correction.
Example of this specific finding
Illustrative control case: An audit reports missing protective headers. Whether a frame lock is suitable depends on whether the page should be consciously embedded.
follow-up audit in Magento
Check Storefront, Account and Checkout separately. A public catalogue page rule must not inadvertently release personal responses or block necessary payment functions.
For each header, determine protection goals and affected responses. First compare a content security policy with the actually required resources and test functions.
Derogations and scope
Blindly copied headers can damage embeddings, payment or scripts. The number of headers set is not an independent proof of quality.
Reference: Magento Open Source or Adobe Commerce with classic storefront. Consider store views and extensions; other storefront architectures have their own configurations.
Classify the general error
Definition, system-independent causes and further correction examples: Configure each header according to its protective task