HTTP security headers: what to check and why

Headers tell the real story

Browsers render HTML, but servers speak in headers first. Response headers control caching, security policy, cookies, compression, and redirects. Misconfigured headers cause subtle bugs: stale content served after deploys, clickjacking vulnerabilities, or HTTPS downgrade attacks. Developers often debug for hours while the fix is a one-line header change.

Qikot's HTTP header checker sends a HEAD request and lists every header returned, plus status code and response time. Use it after deploys, CDN changes, and security audits.

Strict-Transport-Security (HSTS)

HSTS tells browsers to always use HTTPS for your domain for a specified max-age. Without it, users typing http:// may hit plaintext first — vulnerable to sslstrip attacks on hostile networks. Look for Strict-Transport-Security with max-age of at least 31536000 (one year) on production sites. includeSubDomains and preload strengthen policy but require careful planning.

Pair HSTS review with SSL certificate monitoring — HSTS is useless if certificates expire. After enabling HSTS, monitor for mixed content warnings that block assets.

Content-Security-Policy (CSP)

CSP restricts which scripts, styles, and frames may load on your pages. Strong CSP blocks XSS payloads even when developers make template mistakes. Policies appear in Content-Security-Policy or Content-Security-Policy-Report-Only headers. Start in report-only mode to collect violations before enforcing.

Third-party widgets (analytics, chat, payments) complicate CSP. Document each allowed origin. Re-scan headers after marketing adds a new tag manager.

Caching and performance headers

Cache-Control, ETag, and Age reveal whether a CDN serves fresh content. stale-while-revalidate improves perceived speed. no-store belongs on authenticated pages, not public marketing assets. After deployments, if users report old UI, headers often show public, max-age=31536000 on HTML — a misconfiguration.

Compare header checker results with ping test latency. Cached responses should be faster than origin round-trips. If not, the CDN may be bypassed.

Other headers worth reviewing

X-Content-Type-Options: nosniff prevents MIME sniffing attacks. X-Frame-Options or frame-ancestors in CSP mitigates clickjacking. Referrer-Policy controls leakage of URLs to third parties. Permissions-Policy restricts powerful APIs like geolocation and camera. Server and Via headers expose infrastructure — not secret, but useful when tracing unexpected hops.

Run the checker on API endpoints too, not just marketing pages. JSON APIs still need security headers and correct Content-Type.

Workflow integration

Add header checks to release checklists alongside uptime monitor smoke tests. Save before/after snapshots in pull requests. When migrating DNS per our DNS propagation guide, verify headers at the new edge before closing the change ticket.

Free header inspection closes the gap for teams without expensive DAST scanners. Use the HTTP header checker weekly on production URLs and catch drift before attackers do.

Cookies and privacy headers

Set-Cookie attributes matter: Secure, HttpOnly, and SameSite reduce session theft. Inspect cookie headers after deploys — staging environments accidentally leak overly permissive cookies to production domains when misconfigured. The HTTP header checker surfaces Set-Cookie lines for review.

Referrer-Policy and Permissions-Policy demonstrate privacy maturity to regulators and customers. They complement TLS from SSL checker reviews.

Automating header regression tests

Save expected header snapshots after baselining production. Compare weekly — unexpected removal of HSTS should page someone. Pair with uptime monitor smoke tests in CI/CD pipelines calling public URLs after deploy.

When headers change during CDN onboarding, revisit DNS propagation guides to ensure traffic actually hits the new edge before trusting header output.

Security scanners vs manual review

Automated scanners miss context — they flag missing headers without knowing your app is a static marketing site with no auth. Human review via HTTP header checker interprets which headers matter for your threat model. APIs need stricter CSP than brochureware.

Share header reports with penetration testers to accelerate retests. Fixing HSTS and cookie flags before reassessment often closes low-hanging findings cheaply.

Document exceptions when marketing requires inline scripts — exceptions without expiry dates become permanent vulnerabilities. Review quarterly with the same discipline as SSL certificate monitoring.

Use the HTTP header checker after enabling new analytics or chat widgets — third-party scripts frequently require CSP connect-src and script-src updates. A green uptime monitor result does not prove headers remain secure after marketing changes.

Header priority for small sites

Brochure sites should prioritize HSTS, X-Content-Type-Options, and Referrer-Policy first — quick wins with minimal breakage risk. Add Content-Security-Policy incrementally: start with report-only mode if your CDN supports it, then enforce after reviewing violations. E-commerce and login flows need stricter cookie flags and frame-ancestors directives to block clickjacking on checkout pages.

Run the HTTP header checker on staging before production cutover. Compare results against production weekly using the same URL list from your uptime monitor checklist. Pair header reviews with SSL checker runs so TLS and application-layer security stay synchronized after every deploy.

CORS and cross-origin API headers

Cross-Origin Resource Sharing headers control which web origins may call your API from browser JavaScript. Access-Control-Allow-Origin set to asterisk suits public read-only APIs; authenticated APIs need explicit origin allowlists. Misconfigured CORS breaks frontend applications while curl from servers works fine — a classic false negative where Uptime Monitor reports green on API health but customer dashboards fail silently.

Inspect Access-Control-Allow-Methods, Allow-Headers, and Allow-Credentials via the HTTP Header Checker after API deploys. Preflight OPTIONS requests return different headers than GET — check both when SPAs report mysterious network errors. Document allowed origins in developer docs and re-scan when marketing adds new subdomain hosting micro-frontends.

Permissions-Policy deep dive

Permissions-Policy replaces Feature-Policy for controlling browser capabilities: camera, microphone, geolocation, payment, USB. Restricting payment to same-origin reduces clickjacking on checkout pages. E-commerce sites should explicitly disable unused sensors rather than relying on default browser behavior — penetration testers flag over-permissive policies.

Compare staging and production Permissions-Policy after CDN template changes. Some CDNs inject default policies overriding origin — HTTP Header Checker on public URL reveals effective policy customers receive, not merely what nginx config file specifies.

Cross-Origin-Opener-Policy and isolation

COOP and COEP headers enable cross-origin isolation required for SharedArrayBuffer and high-resolution timers in advanced web apps. Most marketing sites omit these; SaaS dashboards with WebAssembly or canvas exports may require them. Incorrect isolation headers break third-party widget embeds — test thoroughly before enforcing.

Security headers stack: HSTS from SSL Checker companion TLS review, CSP against XSS, COOP against cross-window attacks, frame-ancestors against clickjacking. No single header suffices; weekly HTTP Header Checker sweeps catch drift across the stack.

Header injection at CDN versus origin

CDNs append, override, or strip headers depending on configuration mode. Origin may send strict CSP while CDN strips it for compatibility — effective security weaker than developers assume. After Cloudflare or Fastly onboarding, compare origin direct headers versus public URL headers side by side.

Maintain header baseline JSON in version control: URL, timestamp, normalized header key-value pairs. CI job fetching public URLs post-deploy diffs against baseline — unexpected HSTS removal pages on-call before attackers exploit downgrade. Pair with Website Down Checker smoke tests in same pipeline.

Accessibility and security header overlap

Some security headers affect accessibility tooling — overly strict CSP blocks inline accessibility widgets; test with screen readers after CSP enforcement. Referrer-Policy strict-no-referrer may break analytics integrations marketing depends on — balance security with business requirements documented in exception register.

Review exceptions quarterly with security and marketing stakeholders — expired exceptions become permanent vulnerabilities. All free monitoring tools on Qikot require no pipeline setup for teams not yet running CI header regression — manual weekly baseline still beats no baseline.

Incident response for header regressions

When penetration test or bug bounty reports missing headers, confirm with HTTP Header Checker on exact URL cited — scoped tests sometimes hit different path than production default. Fix forward in deploy, verify live, document in ticket, schedule retest.

If headers disappear during CDN outage recovery, include header re-verification in recovery checklist alongside Uptime Monitor availability confirmation. Outages distract teams; security regressions during recovery common without explicit checklist item.

Building organizational header standards

Publish internal standard: required headers per site tier — public marketing, authenticated app, API JSON. Tier-one e-commerce requires HSTS, CSP, nosniff, Referrer-Policy minimum. Provide copy-paste nginx and Cloudflare examples. New projects inherit standard in scaffolding templates.

Audit acquired products against standard within ninety days of acquisition — technical debt from inherited infrastructure often includes absent headers on legacy subdomains nobody monitored. Domain Expiry Checker portfolio review combined with header audit discovers forgotten hostnames simultaneously.

Reporting headers to stakeholders

Non-technical executives do not read raw header dumps — translate findings into risk language: missing HSTS enables downgrade attacks on public Wi-Fi; absent CSP increases XSS blast radius; permissive CORS exposes customer data to untrusted sites embedding your API. Provide one-page summary with red-yellow-green per header per URL tier.

Use HTTP Header Checker screenshots in quarterly security board slides — visual proof of improvement after remediation sprints. Compare before and after deploy timestamps to demonstrate engineering velocity on security backlog, not merely checkbox compliance.

Legacy application exceptions

Older applications may break under strict CSP or HSTS preload — document time-bound exceptions with sunset dates and compensating controls. Web Application Firewall rules partially compensate for absent CSP on legacy apps while rewrite proceeds. Exception register reviewed monthly prevents temporary waivers becoming permanent debt.

Staging environments mirroring production headers catch breakage before enforcement — run checker on staging with proposed headers enabled in report-only mode first. Product owners sign off on CSP breaking third-party widgets before enforcement cuts marketing analytics silently.