'unsafe-inline' weakens script and style restrictions.
'unsafe-eval' allows eval and similar; consider removing.
X-Frame-Options
good
SAMEORIGIN
X-Content-Type-Options
good
nosniff
Referrer-Policy
weak
no-referrer-when-downgrade
'no-referrer-when-downgrade' leaks referrer info more than recommended; prefer strict-origin-when-cross-origin.
Permissions-Policy
missing
Permissions-Policy header is not set.
Cross-Origin-Opener-Policy
missing
Cross-Origin-Opener-Policy header is not set.
Cross-Origin-Embedder-Policy
missing
Cross-Origin-Embedder-Policy header is not set.
Cross-Origin-Resource-Policy
missing
Cross-Origin-Resource-Policy header is not set.
Server disclosure
Server
Apple
X-Powered-By
(not exposed)
Recommendations
Add Permissions-Policy to disable browser features you do not need (camera, microphone, geolocation, etc.).
Auto-fix: copy these headers into your server config
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), interest-cohort=()" always;
# Disables features you almost certainly do not need. Add features back inside the parens if your site does need them.
Add inside the server { ... } block (or location / for path-scoped).
Reload with `nginx -s reload` after editing. Use `always` so headers are sent on error responses too.
AI-assisted remediation
Want a tailored fix plan in plain English?
Wiredepth Pro sends this report to our AI engine and streams back a 30-day rollout plan tailored to apple.com, with provider-specific tips when we can infer them from the data. 10 playbooks per month on Pro, 100 on MSP.