> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/knowledge-base/english/observer/which-http-headers-does-the-enginsight-observer-check.md).

# Which HTTP headers does the Enginsight Observer check?

The Observer is an Enginsight component that can be installed on systems at different locations to monitor endpoints externally. In Enginsight, endpoints are internal and external websites and domains.

Monitoring also includes checking whether security-relevant HTTP headers exist and are configured correctly. If HTTP headers are not configured correctly, a corresponding recommendation is displayed.

The following HTTP headers are checked by the Observer:

<table><thead><tr><th width="219.22265625">Name</th><th width="200.28515625">Recommended attributes</th><th>Description</th></tr></thead><tbody><tr><td>Content-Security-Policy</td><td></td><td>The Content-Security-Policy header defines which resources may be loaded or executed in the browser in a specific way and which sources are trusted. This helps prevent malicious injected code from being executed.</td></tr><tr><td>Expect-CT</td><td>max-age=0</td><td>The Expect-CT header instructs the browser to enforce Certificate Transparency requirements. This helps prevent the use of certificates that have been issued fraudulently or incorrectly.</td></tr><tr><td>Feature-Policy</td><td><p>accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none';</p><p>usb 'none'</p></td><td>The Feature-Policy header defines which browser features or APIs may be used and which are not permitted. It improves security and privacy by minimizing the attack surface and disabling unused features.</td></tr><tr><td>Referrer-Policy</td><td>no-referrer-when-downgrade</td><td>The Referrer-Policy header ensures that information about where a website visitor came from is only sent under specific conditions. This helps prevent passwords in URLs or session IDs, for example, from being passed on to third parties.</td></tr><tr><td>Strict-Transport-Security</td><td><p>max-age=31536000;</p><p>includeSubDomains</p></td><td>HTTP Strict Transport Security (HSTS) is a security mechanism for HTTPS connections that protects against both attempts to bypass connection encryption and session hijacking.</td></tr><tr><td>X-Content-Type-Options</td><td>nosniff</td><td>The X-Content-Type-Options header prevents a browser from guessing the MIME (Multipurpose Internet Mail Extensions) data format of a file and using a content type other than the one specified by the server.</td></tr><tr><td>X-Frame-Options</td><td><p>DENY</p><p>(SAMEORIGIN)</p><p>(ALLOW-FROM https://example.com/)</p></td><td>The X-Frame-Options header tells the browser whether it is allowed to render, meaning embed, a website in a &#x3C;frame>, &#x3C;iframe>, or &#x3C;object>. This prevents attackers from placing a page in an invisible frame over a fake website in order to trick visitors into unintended clicks.</td></tr><tr><td>X-XSS-Protection</td><td><p>1;</p><p>mode=block</p></td><td>The X-XSS-Protection header can instruct browsers not to load a website if malicious inline code is detected that indicates a Cross-Site Scripting (XSS) attack.</td></tr></tbody></table>

***