Header Security

Shopify Content-Security-Policy Header Check

The Content-Security-Policy (CSP) header is essential to prevent XSS attacks on your Shopify store. Check its configuration and enhance your security.

What this test checks

This test checks the presence and configuration of the Content-Security-Policy (CSP) header on your Shopify store. This header allows you to control allowed content sources, limiting the risk of malicious script injection (XSS) and unauthorised resource loading.

Our recommendation

Add or strengthen your CSP policy with restrictive directives. Use 'default-src self' as a base and add necessary sources for your scripts, styles, and images. Test your policy in 'report-only' mode before applying it in production.

Security tests

View all tests

Sensitive Files

Shopify Content-Security-Policy Header Check

What this test checks

Our recommendation

Read more

Shopify Log File Exposure Check

Magento Log File Exposure Check

Drupal Admin Access Check

Magento Version Check

Shopify API Key Exposure Check

Shopify Error Display Check

Login Attempt Limiting Check

Upload Folder Indexing Check

PrestaShop Admin Access Check

Shopify Admin Access Restriction Check

Shopify Backup File Exposure Check

Shopify Permissions-Policy Header Check

Shopify Upload Folder Security Check

CNIL Mention in Privacy Policy Check

Drupal Upload Folder Indexing Check (sites/default/files/)

WordPress Version Check

.htaccess File Presence and Security Check

Joomla REST API Access Check

Magento Admin Login Page Protection Check

Information Leak via HTTP Headers Check

Shopify Password Reset CAPTCHA Protection Check

Joomla Temporary Folder (/tmp/) Access Check

SQL Query Exposure Check

Joomla Log File Exposure Check

CAPTCHA Presence on Client Login Page Check

Shopify Environment Information Exposure Check

PrestaShop Admin Access Restriction Check

WordPress Heartbeat API Check

Referrer-Policy Header Check

PrestaShop Log File Exposure Check

Drupal Version Check

Magento Backup File Exposure Check

CMS Vulnerability Check

Drupal Backup File Exposure Check

WordPress Login Page Access Check (wp-login.php)

Drupal Log File Exposure Check

robots.txt File Check

Drupal Admin Access Restriction Check

Cross-Origin-Opener-Policy Header Check

Cookie Consent Banner Presence Check

WordPress Admin Access Check

PrestaShop Session Cookie Security Check

Joomla Admin Login Page Protection Check

Shopify Storefront API Exposure Check

Magento env.php File Access Check

Joomla configuration.php File Access Check

CAPTCHA Presence on Admin Page Check

PHP Error Display on Drupal Check

WordPress Upload Folder Indexing Check (wp-content/uploads/)

PrestaShop Upload Folder Indexing Check

HttpOnly Flag on Joomla Session Cookies Check

Shopify XSS Protection Check

Email Address Exposure Check

Shopify HTTP Security Headers Check

WordPress REST API Access Check

API Key Exposure Check

Installation Log File Exposure Check

PHP Error Display on Magento Check

PrestaShop parameters.php File Access Check

Index File Presence in Upload Folders Check

X-Frame-Options Header Check

Joomla configuration.php Exposure Check

PHP Error Display on PrestaShop Check

Configuration File Exposure Check

Joomla Admin Access Check

Joomla Cron Access Check

Content-Security-Policy Header Check

PHP Error Display in Production Check

CAPTCHA Presence on Password Reset Form Check

WordPress Backup File Exposure Check

Magento Admin Access Restriction Check

Shopify HSTS Header Check

Joomla Upload Folder Indexing Check (images/)

Shopify Referrer-Policy Header Check

CAPTCHA Presence on Contact Form Check

Shopify Version Check