HTTP security headers guide
Find web security header gaps before attackers do
HTTP response headers give browsers instructions that reduce common attack paths. This security headers scanner checks a public URL and turns the response into a practical hardening checklist for application and platform teams.
Headers that matter most
A strong baseline usually includes a carefully designed Content-Security-Policy, HSTS, clickjacking protection, MIME sniffing protection, a deliberate Referrer-Policy, and a restrictive Permissions-Policy. Cookie attributes also matter because they control how browser credentials are sent.
- Content-Security-Policy
- Strict-Transport-Security
- X-Frame-Options or frame-ancestors
- Secure, HttpOnly, and SameSite cookies
How to prioritize findings
Start with headers that reduce direct exploitability, then validate compatibility with every application flow and third-party integration. Use report-only policies and staged rollouts when a change could block legitimate scripts, frames, or API requests.
Passive URL scanning
The scanner reads the public HTTP response and does not attempt to exploit the target. Run it against a staging environment during development, then repeat it after deployment so reverse proxies, CDNs, and platform defaults are included in the check.