<?xml version="1.0" encoding="UTF-8"?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
<url>
<loc>https://headertest.com</loc>
<lastmod>2026-10-05T13:55:09.018Z</lastmod>
<changefreq>daily</changefreq>
<priority>1</priority>
</url>
<url>
<loc>https://headertest.com/about</loc>
<lastmod>2026-10-05T13:55:09.018Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://headertest.com/features</loc>
<lastmod>2026-10-05T13:55:09.018Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://headertest.com/guides</loc>
<lastmod>2026-10-05T13:55:09.018Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://headertest.com/docs</loc>
<lastmod>2026-10-05T13:55:09.018Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://headertest.com/blog</loc>
<lastmod>2026-10-05T13:55:09.018Z</lastmod>
<changefreq>daily</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://headertest.com/results</loc>
<lastmod>2026-10-05T13:55:09.018Z</lastmod>
<changefreq>hourly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://headertest.com/analytics</loc>
<lastmod>2026-10-05T13:55:09.018Z</lastmod>
<changefreq>daily</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://headertest.com/signup</loc>
<lastmod>2026-10-05T13:55:09.018Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.5</priority>
</url>
<url>
<loc>https://headertest.com/security-policy</loc>
<lastmod>2026-10-05T13:55:09.018Z</lastmod>
<changefreq>yearly</changefreq>
<priority>0.3</priority>
</url>
<url>
<loc>https://headertest.com/guides/strict-transport-security</loc>
<lastmod>2026-10-05T13:55:09.018Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://headertest.com/guides/x-content-type-options</loc>
<lastmod>2026-10-05T13:55:09.018Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://headertest.com/guides/x-frame-options</loc>
<lastmod>2026-10-05T13:55:09.018Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://headertest.com/guides/x-xss-protection</loc>
<lastmod>2026-10-05T13:55:09.018Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://headertest.com/guides/referrer-policy</loc>
<lastmod>2026-10-05T13:55:09.018Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://headertest.com/guides/permissions-policy</loc>
<lastmod>2026-10-05T13:55:09.018Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://headertest.com/guides/cross-origin-opener-policy</loc>
<lastmod>2026-10-05T13:55:09.018Z</lastmod>
<changefreq>monthly</changefreq>
<priority>0.7</priority>
</url>
<url>
<loc>https://headertest.com/blog/beyond-security-headers-attack-surface-open-ports-cves-dns</loc>
<lastmod>2026-10-04T18:16:18.859Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://headertest.com/blog/content-security-policy-nextjs</loc>
<lastmod>2026-07-18T13:26:27.552Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://headertest.com/blog/security-headers-nginx</loc>
<lastmod>2026-07-18T13:25:27.552Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://headertest.com/blog/security-headers-apache</loc>
<lastmod>2026-07-18T13:24:27.552Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://headertest.com/blog/security-headers-cloudflare</loc>
<lastmod>2026-07-18T13:23:27.552Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://headertest.com/blog/stopping-dom-xss-with-trusted-types-and-csp</loc>
<lastmod>2026-07-18T12:27:46.829Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://headertest.com/blog/deploy-csp-without-breaking-site-report-only</loc>
<lastmod>2026-05-28T19:47:06.324Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://headertest.com/blog/how-csp-level-3-stops-xss-and-what-to-pair-it-with</loc>
<lastmod>2026-03-11T14:32:38.653Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://headertest.com/blog/headertest-out-of-beta-scoring-updates</loc>
<lastmod>2026-02-15T17:54:28.977Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://headertest.com/blog/nextjs-sanity-cms-csp-image-proxy-security</loc>
<lastmod>2026-02-08T19:00:52.216Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://headertest.com/blog/what-is-content-security-policy-csp-complete-guide</loc>
<lastmod>2026-01-13T21:14:00.054Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://headertest.com/blog/http-security-headers-complete-checklist</loc>
<lastmod>2026-01-12T21:14:00.054Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://headertest.com/blog/how-to-fix-unsafe-inline-in-csp</loc>
<lastmod>2026-01-11T21:14:00.054Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://headertest.com/blog/top-10-csp-mistakes-developers-make</loc>
<lastmod>2026-01-10T21:14:00.054Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/cross-site-scripting</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/infrastructure-security</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/next-image-proxy</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/nonce-csp</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/strict-transport-security</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/mod-headers</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/xss</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/security</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/referrer-policy</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/deploy-csp</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/next-js</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/website-security</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/innerhtml-xss</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/csp</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/reporting-api</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/sanity-cms-security</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/content-security-policy-report-only</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/nonce</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/content-security-policy</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/report-uri</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/x-content-type-options</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/csp-rollout</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/transform-rules</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/report-to</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/nextjs</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/dns</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/cve</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/security-headers</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/apache</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/web-security</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/xss-protection</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/x-frame-options</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/dompurify</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/domain-history</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/unsafe-inline</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/trusted-types-directive</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/attack-surface</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/cloudflare</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/csp-level-3</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/headertest</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/trusted-types</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/csp-violations</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/spf</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/csp-analyzer</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/csp-report-only</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/dom-xss</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/next-js-csp</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/permissions-policy</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/next-js-security-headers</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/csp-mistakes</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/sanity-cdn</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/strict-dynamic</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/security-scoring</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/require-trusted-types-for</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/image-optimization-security</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/nginx</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/csp-errors</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/open-ports</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/http-headers</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/dom-based-xss</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/hsts</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/xss-prevention</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/osn</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
<url>
<loc>https://headertest.com/blog/tag/hash</loc>
<lastmod>2026-10-05T13:55:09.046Z</lastmod>
<changefreq>weekly</changefreq>
<priority>0.4</priority>
</url>
</urlset>
