Header Security

Shopify HSTS Header Check

The HSTS (Strict-Transport-Security) header forces HTTPS connections on your Shopify store. Check its presence and learn how to configure it to enhance security.

What this test checks

This test checks whether the HSTS header is present on your Shopify store. This header forces browsers to connect exclusively over HTTPS, protecting your customers against downgrade attacks and connection hijacking. Its absence exposes your site to security risks.

Our recommendation

Add the HSTS header with a minimum duration of 31536000 seconds (1 year) in your Shopify server configuration. Use Shopify's built‑in security settings to configure this header. Test your configuration with browser developer tools.

Security tests

View all tests

Sensitive Files

Shopify HSTS Header Check

What this test checks

Our recommendation

Read more

WordPress Backup File Exposure Check

Shopify X-Frame-Options Header Check

WordPress Uploads Folder Protection Check (.htaccess, index.html files)

Shopify phpinfo Exposure Check

WordPress REST API Access Check

Joomla REST API Access Check

Magento Admin Access Restriction Check

Shopify Sensitive File Exposure Check

Cross-Origin-Resource-Policy Header Check

Shopify HTTP Security Headers Check

Server Status Pages Access Check

Shopify Admin Access Restriction Check

Joomla Log File Exposure Check

Index File Presence in Upload Folders Check

WordPress Theme Editor Access Check

API Key Exposure Check

Magento Admin Login Page Protection Check

Joomla Temporary Folder (/tmp/) Access Check

Drupal Temporary Folder (tmp/) Access Check

Shopify File Upload Security Check

Magento Admin Access Check

PrestaShop Admin Login Page Protection Check

Magento Cache Folder Access Check

Joomla Version Check

Shopify Password Reset CAPTCHA Protection Check

CNIL Mention in Privacy Policy Check

Magento Backup File Exposure Check

Cookie Security Check

PHP Error Display on Magento Check

PHP Error Display on Drupal Check

Upload Folder Indexing Check

Upload Folder Protection Check (.htaccess, index.html files)

Joomla Backup File Exposure Check

Drupal Version Check

Installation Log File Exposure Check

Drupal Admin Login Page Protection Check

PrestaShop Upload Folder Indexing Check

Cookie Consent Banner Presence Check

Shopify Error Display Check

.htaccess File Presence and Security Check

Drupal Backup File Exposure Check

CMS Vulnerability Check

Drupal Admin Access Check

WordPress Admin Access Check

WordPress Heartbeat API Check

CORS Configuration Check (Access-Control-Allow-Origin)

Shopify Version Check

X-Content-Type-Options: nosniff Header Check

wp-config.php File Access Check

WordPress Version Check

Server Configuration Information Check

Database Backup File Exposure Check

Magento Configuration File Exposure Check

Drupal Admin Access Restriction Check

CAPTCHA Presence on Password Reset Form Check

Shopify Permissions-Policy Header Check

CAPTCHA Presence on Contact Form Check

HSTS Header Check (HTTP Strict Transport Security)

PrestaShop Session Cookie Security Check

Shopify Storefront API Exposure Check

Cross-Origin-Embedder-Policy Header Check

Shopify Cart Endpoint Exposure Check

Drupal Log File Exposure Check

Shopify Content-Security-Policy Header Check

Magento Session Cookie Security Check

CAPTCHA Presence on Client Login Page Check

Shopify Password Protection Check

Database Administration Tools Access Check

SQL Query Exposure Check

Permissions-Policy Header Check

Shopify REST API Exposure Check

Plaintext Password Exposure Check

SSL Certificate Check

PrestaShop Log File Exposure Check

Development File Exposure Check

CAPTCHA Presence on Registration Page Check