What security headers does MetriFi set, and why isn't there a CSP?

Which security headers are set on my site

MetriFi applies a standard set of security headers at the server level when your site launches:

• X-Content-Type-Options — stops browsers from second-guessing a file's type, which is a common way malicious content gets executed.
• X-Frame-Options — prevents other websites from embedding your pages in a frame, which protects against clickjacking.
• X-Download-Options — stops downloaded files from opening directly in the browser context.
• Strict-Transport-Security — tells browsers to only ever connect to your site over a secure connection, for a year at a time, including subdomains.
• Referrer-Policy — controls how much address information is passed along when a visitor follows a link off your site.

Cache directives (Pragma and Cache-Control) are applied to page responses at the same time. These aren't security headers, but they're part of the same configuration and often appear in scan results alongside them.

Most of these apply to your site's pages specifically, rather than to every file on the server. If a scan reports a header on one URL but not another, that's usually why.

Are these headers checked after launch

Yes. Each quarterly security scan re-checks that these headers are still active, so if something on the server changes, it's caught at the next scan rather than going unnoticed.

Why isn't a Content Security Policy (CSP) set

MetriFi does not configure CSP or Permissions-Policy headers.

A Content Security Policy works by listing exactly which sources a page is allowed to load scripts, styles, fonts and frames from. That conflicts directly with Google Tag Manager, which is how third-party tools are added to your site — chat widgets, tracking pixels, accessibility overlays and similar. A policy strict enough to satisfy a security scan will block those tags, often silently, and the breakage typically shows up as a feature quietly not working rather than as an obvious error.

It also isn't a one-time setting. Every time your team adds, changes or removes a tag in your GTM container, the policy may need updating to match. How much ongoing maintenance that involves depends entirely on what your container holds.

Can we add a CSP or Permissions-Policy anyway

Yes, and some organisations choose to. Because these are server-level headers, this is work for your web host — they manage the server configuration where the headers are set.

Before you start, it's worth having whoever manages your GTM container list what's currently in it, so your host can build a policy around it and you know what to re-test afterwards.

Who makes changes to security headers

Your web host. Security headers are part of the server configuration, which sits outside the website itself. MetriFi supports your site's design, content and functionality; the server and its configuration are the host's responsibility.

If a security scan or audit flags a header on your site, send that finding to your hosting provider. If they identify something website-level they'd like us to review, we're glad to help.