Security headers review
Ten checks over the response headers a browser acts on, grouped by what each one actually defends. Read them from a real response rather than from the server block, and read them from more than one route: a redirect, an error page and an asset are answered by different code paths, and the headers on your homepage say nothing about the headers on your login endpoint. Where two items overlap, the list says which one wins in the browser, because that is the part configuration guides usually leave out.
11 checksabout 65 min end to end
The sweep
- How to check security headers
One pass that shows what is present and, more usefully, which responses are missing what the homepage has. - How to check HTTP response headers with curl
The reading skill the rest of the list depends on, including why a HEAD request can answer differently.
Script and content execution
- How to check CSP header
The only header here that constrains what already-loaded script may do, and the easiest to write permissively by accident. - How to check X-Content-Type-Options
Stops a browser from deciding for itself that your data file is a script. - How to check subresource integrity
A pinned hash is what turns a third-party script from trust into verification.
Framing and navigation
- How to check if a site is vulnerable to clickjacking
Test the framing behaviour end to end, because the headers that control it contradict each other. - How to check X-Frame-Options
The older header is ignored wherever frame-ancestors is present, which is not what its name suggests. - How to check referrer-policy header
A token or an object id in a URL leaks to every third-party host the page talks to.
Capabilities and transport
- How to check permissions-policy header
Decides which browser features embedded content may reach for, which nothing else on this list covers. - How to check if HSTS is enabled
Headers only matter on connections that happen over TLS, and this is what guarantees the next one does. - How to check if cookies are secure and HttpOnly
The flags travel in a response header like the rest, and are checked the same way.
Take it with you
The file is the same list as Markdown checkboxes, ready to paste into a release ticket or a pull request description.
Ticks are kept in this browser only. They are not sent anywhere and other people do not see them.