Runtime verification: security header probes

Last updated: October 16, 2026

The .htaccess Hardening window checks the rules in your file. The Runtime verification section at the top checks what visitors' browsers actually receive - a CDN, server setting or inactive module can make the two differ. Click Verify now to refresh it (Pro).

New probes in 5.1.0

Clickjacking protection - X-Frame-Options or a CSP frame-ancestors directive on the homepage.
Referrer-Policy header present.
Backend login page headers - nosniff and frame protection on /administrator/ (shown as not verified if a password gate or redirect sits in front of it).
Server banner - flags exact version numbers in the Server and X-Powered-By headers.
Content-Security-Policy - advisory only. A wrong CSP can break a site, so MuRu Guard only tells you whether one is served.

A probe that cannot reach your site reports Not verified, never a failure.