These are the browser protections attached to every ChessUrge response. The report lists the current policy, whether it passes our own check, and what we still recommend.
This deployment is served over HTTPS, so transport-dependent headers are active. 3 hardening gaps remain, listed below.
Strict-Transport-SecurityTells browsers to use HTTPS for this site for the next year, including subdomains.
Recommendation: Consider adding preload once every subdomain is HTTPS-only, then submit the domain to the HSTS preload list.
Content-Security-PolicyBlocks framing by other sites, plugin content, base-tag hijacking and form posts to unknown origins.
Recommendation: Extend the policy with default-src and script-src, first in Content-Security-Policy-Report-Only, and add a reporting endpoint before enforcing it.
X-Frame-OptionsPrevents other origins from embedding ChessUrge pages in a frame. CSP frame-ancestors provides the modern equivalent.
Recommendation: Keep both X-Frame-Options and frame-ancestors while older browsers are supported.
Referrer-PolicySends only the origin to other sites and avoids leaking private paths or query strings in the Referer header.
Recommendation: No change needed. Avoid loosening this to unsafe-url.
X-Content-Type-OptionsStops browsers from guessing a response type and executing content as a different type.
Recommendation: No change needed.
Permissions-PolicyDisables sensitive browser features that ChessUrge does not need.
Recommendation: Review if a future feature needs one of these capabilities; keep the default deny otherwise.
Cross-Origin-Opener-PolicyIsolates the browsing context from cross-origin windows, reducing cross-window attacks.
Recommendation: No change needed.
Cross-Origin-Resource-PolicyPrevents other origins from loading ChessUrge subresources such as images and scripts.
Recommendation: Relax only for resources that must be embedded elsewhere, and prefer a dedicated public path.
The current CSP protects framing, plugins, the base URI and form actions, but it does not restrict where scripts, styles or images load from. A full policy is the largest remaining XSS hardening step.
Recommendation: Build a report-only policy from the scripts actually loaded (self, Google Analytics, AdSense when enabled, Cloudflare Turnstile when enabled) and enforce it after the reports are clean.
There is no report-uri or report-to directive, so violations are invisible unless a browser console happens to be open.
Recommendation: Add a report-to group and a small collection endpoint, then review reports before tightening directives.
The production HSTS policy has a one-year max-age and includeSubDomains, but no preload directive.
Recommendation: Add preload only after every ChessUrge subdomain is permanently HTTPS-only; preload removal is slow.
Security headers can change at the edge. Run this against the live host instead of trusting a page about itself.
curl -sSI https://chessurge.org | grep -iE \
'content-security-policy|strict-transport-security|X-Frame-Options|referrer-policy|x-content-type-options'The report reflects the SvelteKit response policy in hooks.server.ts plus the nginx edge configuration. A CDN or reverse proxy in front of
the app can add, remove or rewrite headers.