SECURITY HEADERS CHECKER

Why Headers Matter

HTTP security headers are the last line before the browser. A missing X-Frame-Options means your login page can be loaded inside an attacker’s iframe and clickjacked. Missing Strict-Transport-Security means your users’ first visit over plain HTTP can be downgraded and the session cookie sniffed. Permissive CORS means other sites can read your authenticated responses with the user’s cookies attached.

The headers themselves are simple key-value strings — they fix entire vulnerability classes for the cost of one config block. They’re also the cheapest, fastest hardening pass an app will ever get.

The Grade Card

Each header gets scored Pass / Warn / Fail with specific guidance:

Header reference table

How attackers find this

Header misconfigurations are trivially scanned. There are public scanner indexes (securityheaders.com, Mozilla Observatory, plus dozens of “security report” SaaS bots) that crawl deployed sites continuously and publish grades. Attackers don’t need to scan you — they just query the index.

For specific exploits:

• Missing HSTS — sslstrip-style downgrades on hostile networks (open Wi-Fi, hotel captive portals). The first request a user makes to yoursite.com is plain HTTP; the attacker rewrites the redirect.
• Missing X-Frame-Options — attacker hosts attacker.com/win-a-prize, embeds yoursite.com/transfer-funds in a transparent iframe over a “click here” button. User clicks button on attacker site, actually clicks the transfer button on your site, with their cookies attached.
• Access-Control-Allow-Origin: * with credentials — when paired with Allow-Credentials: true (browsers reject this combo, but bad servers send * anyway and developers then “fix” it by reflecting the Origin header without validation), any site can read authenticated responses.
• Missing CSP — every reflected XSS becomes a full account takeover, because the injected script can call any origin and exfiltrate cookies/localStorage.
• Server and X-Powered-By headers — version disclosure. Attacker reads Express 4.17.1, looks up CVEs for that version, knows exactly which exploits apply.

Host-Specific Recipes

The report includes paste-ready config for every target. Common ones:

vercel.json:

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        { "key": "Strict-Transport-Security", "value": "max-age=31536000; includeSubDomains; preload" },
        { "key": "X-Content-Type-Options", "value": "nosniff" },
        { "key": "Referrer-Policy", "value": "strict-origin-when-cross-origin" },
        { "key": "Permissions-Policy", "value": "camera=(), microphone=(), geolocation=(), payment=()" },
        { "key": "Content-Security-Policy", "value": "default-src 'self'; script-src 'self' 'nonce-{NONCE}'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" }
      ]
    }
  ]
}

Netlify _headers:

/*
  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()
  Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'

Express + Helmet:

import helmet from 'helmet';

app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'", (req, res) => `'nonce-${res.locals.nonce}'`],
      objectSrc: ["'none'"],
      baseUri: ["'self'"],
      frameAncestors: ["'none'"],
    },
  },
  hsts: { maxAge: 31536000, includeSubDomains: true, preload: true },
  crossOriginOpenerPolicy: { policy: 'same-origin' },
}));

Nginx:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
add_header Content-Security-Policy "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;

The always flag is mandatory — without it Nginx skips the header on error responses, which is exactly when version-disclosure leaks happen.

CSP rollout strategy

CSP is the one header that will break things if you turn it on cold. Roll out in three stages:

1. Report-only — deploy Content-Security-Policy-Report-Only with report-uri /csp-report. Browsers send violation reports; nothing is blocked. Run for 1–2 weeks across your real traffic.
2. Triage reports — every violation is either a real script you missed in the policy (whitelist with hash/nonce) or an actual XSS attempt (good, it would have been blocked).
3. Enforce — promote to Content-Security-Policy. Keep report-uri so regressions surface in CI.

If you can’t host a report endpoint, csp-evaluator.withgoogle.com will at least flag obvious holes in a pasted policy.

Why AI-Generated Apps Fail This

AI generators ship the app first, headers later — or never. Default framework output ships without CSP. CORS gets set to * “temporarily” during debugging and stays. The dev environment never triggered any of these as bugs because everything was same-origin localhost. This checker is the fastest way to catch those drifts.

What this scanner does NOT flag

• Headers set on a different domain. If your assets are on a CDN subdomain that returns its own headers, we test only the URL you submit. Pass each origin separately.
• Edge-case CSP issues. A policy that parses correctly but allows 'unsafe-eval' for a single legitimate library is graded Warn, not Fail — the call is yours.
• Cookie issues for cookies the scanner never sees. We grade the cookies your site sets on a fresh visit. Cookies set only after login require an authenticated re-scan.
• Header order or duplicates from upstream proxies. Some load balancers prepend their own X-Frame-Options. We report the value the browser actually receives; if your app sends DENY and the proxy rewrites it to SAMEORIGIN, the scanner shows the rewritten value.

Related tools and guides

• Token Leak Checker — header hardening matters less if your API keys are in the bundle anyway.
• Vibe Code Scanner — full app scan that reads headers and probes auth and RLS.
• Free Security Self-Audit — manual checklist that pairs with header scanning.