How to check any website's security headers in 30 seconds (and what each one does)
Most small web apps ship without the HTTP headers that tell browsers how to protect their users. They take minutes to add, but nobody checks. Here's how to check yours, and what each header does. Check them wit
Most small web apps ship without the HTTP headers that tell browsers how to protect their users. They take minutes to add, but nobody checks. Here's how to check yours, and what each header does.
Check them with curl
curl -sI https://yourapp.com
Look in the response for these six:
| Header | What it does |
|---|---|
Content-Security-Policy |
Limits which scripts, styles and images may load, which limits the damage of XSS attacks |
Strict-Transport-Security |
Tells browsers to always use HTTPS for your domain |
X-Content-Type-Options: nosniff |
Stops browsers guessing file types (no running an upload as a script) |
X-Frame-Options or CSP frame-ancestors
|
Stops other sites putting your page in an invisible frame (clickjacking) |
Referrer-Policy |
Controls how much of your URL leaks to other sites when people click links |
Permissions-Policy |
Turns off browser features you don't use (camera, microphone, location) |
Or with a few lines of Node
const url = process.argv[2];
const res = await fetch(url, { redirect: 'follow' });
const h = res.headers;
const checks = {
'Content-Security-Policy': h.has('content-security-policy'),
'Strict-Transport-Security': h.has('strict-transport-security'),
'X-Content-Type-Options': /nosniff/i.test(h.get('x-content-type-options') ?? ''),
'X-Frame-Options': h.has('x-frame-options') || /frame-ancestors/i.test(h.get('content-security-policy') ?? ''),
'Referrer-Policy': h.has('referrer-policy'),
'Permissions-Policy': h.has('permissions-policy'),
};
for (const [name, ok] of Object.entries(checks)) console.log(ok ? '✓' : '✗', name);
console.log(`${Object.values(checks).filter(Boolean).length}/6`);
Run it with node check.mjs https://example.com. As of today, example.com scores 0/6.
Adding them on Vercel
{
"headers": [{
"source": "/(.*)",
"headers": [
{ "key": "Strict-Transport-Security", "value": "max-age=63072000; includeSubDomains; preload" },
{ "key": "X-Content-Type-Options", "value": "nosniff" },
{ "key": "X-Frame-Options", "value": "DENY" },
{ "key": "Referrer-Policy", "value": "strict-origin-when-cross-origin" },
{ "key": "Permissions-Policy", "value": "camera=(), microphone=(), geolocation=()" }
]
}]
}
Content-Security-Policy needs care, because a policy that's too strict breaks your own scripts. Start with Content-Security-Policy-Report-Only and tighten it from there.
Why I'm writing this
I kept forgetting these headers on my own projects, along with images that are too heavy and analytics that load before the cookie banner. So I'm building Sprigwork: AI teammates that find these problems with open-source scanners, write the fix in your code, and wait for your approval before anything changes. It's a desktop app, so your code stays on your machine.
The free glass check already works: paste a URL and it reports headers, trackers versus consent, and server response time → https://sprigwork.vercel.app/?utm_source=devto&utm_medium=article
What should I add to the check next?
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.