Technical check group
Security checks
Use SSL if you are interacting with sensitive user data. The catalogue currently contains 13 checks in this group.
| State | Evidence | Owner |
|---|---|---|
| Observed | SecurityPage-level source retained | Audit |
| Reviewed | Decision recordedScope and value inspected | Human |
| Verified | Public response readOutcome has separate proof | System |
Rule catalogue
Review each condition before turning it into work.
Security
Use SSL if you are interacting with sensitive user data.
Mixed Content Issues
HTTPS pages loading HTTP resources cause security warnings. Update all resources to HTTPS.
Form URL Insecure
Forms should submit data to HTTPS URLs to protect user information in transit.
Form on HTTP URL
Pages containing forms should use HTTPS to establish trust and protect data.
Missing HSTS Header
Add Strict-Transport-Security header to force HTTPS connections and prevent downgrade attacks.
Unsafe Cross-Origin Links
Add rel="noopener noreferrer" to external links opening in new tabs to prevent security vulnerabilities.
Protocol-Relative Resource Links
Replace protocol-relative URLs (//example.com) with explicit HTTPS URLs for better security.
Missing Content-Security-Policy Header
Implement Content-Security-Policy header to prevent XSS attacks and control resource loading.
Missing X-Content-Type-Options Header
Add X-Content-Type-Options: nosniff header to prevent MIME type sniffing attacks.
Missing X-Frame-Options Header
Add X-Frame-Options header to prevent clickjacking attacks.
Missing Referrer-Policy Header
Add Referrer-Policy header to control referrer information sent with requests.
Bad Content Type
Ensure all resources are served with appropriate Content-Type headers to prevent security issues.
Mixed Content
An HTTPS page requesting HTTP resources shows a browser warning and can have those resources blocked outright. Serve every asset over HTTPS.