Headers On

The web server for a small shop answers over HTTPS, but it sends none of the response headers that tell a browser how to behave safely. Without them the browser falls back on permissive defaults: it may guess content types, allow the page to be framed by other sites, and accept plain HTTP on a later visit.

Your job is to edit the configuration until the server sends the core set of security headers, and to stop advertising its version. The checker reads your configuration file and tests each item: transport security, content-type sniffing, framing, referrer handling and a content security policy, plus the version disclosure setting. Read each failed check for the reason it matters.

There is one rule you must not break. The site has to keep answering on port 443 and serving its pages, so a change that switches the server off is not a fix. Only when every required check passes do you receive the flag. The lab only reads the text you submit; nothing is applied to a real system, and the check tells you what is still weak and why, never the exact line to type.