Most of the points a security headers scanner takes off a hosted blog are for HTTP response headers. Those come from the host. A theme only controls HTML, and only two of these policies work from HTML at all: a referrer policy via <meta name="referrer"> and a Content Security Policy via <meta http-equiv="Content-Security-Policy"> .

HSTS, X-Frame-Options and X-Content-Type-Options only work as real headers. Browsers ignore them in a meta tag.

I run a blog host ( JustBlogged ), so people send me these reports and ask which lines they can fix themselves. On October 24, 2026 I sat down and actually checked, with the scanner and with a real browser. The part I didnt expect... MDN's HTTP Observatory gives you credit for a frame-ancestors directive in a meta tag, which browsers ignore. Your grade goes up and nothing about framing changes.

How the Observatory scores

The Observatory's scoring is public and its source is on GitHub. Every site starts at 100 and loses points per failed test.…