HTTP Security Header Inspector & Policy Evaluator
Inspect Content-Security-Policy, HSTS, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy in live HTTP headers.
Deep Technical Overview: Security Header Checker
HTTP Security Headers are server response directives that instruct client web browsers how to handle sensitive application data, external resource loading, frame nesting, and protocol strictness. Modern web browsers possess robust security sandboxes, but they rely entirely on server-sent headers to enforce defense boundaries.
Without defensive headers, even well-engineered web applications remain vulnerable to prevalent attack vectors such as Cross-Site Scripting (XSS), Clickjacking, Cross-Site Leak attacks, and MIME sniffing exploits. Modern standards like Content-Security-Policy (CSP), Strict-Transport-Security (HSTS), and Permissions-Policy provide granular, declarative control over browser execution.
The CelebJared Security Header Checker connects to your web host over standard HTTPS, parses raw response headers, and benchmarks every directive against current OWASP and W3C security standards.
Core Technical Signals & Verification Criteria
| Technical Signal | Defensive Significance | Recommended State | Omission Risk / Vulnerability |
|---|---|---|---|
| Strict-Transport-Security (HSTS) | Forces HTTPS connections and protects against SSL stripping attacks. | max-age=31536000; includeSubDomains; preload | Without HSTS, unencrypted HTTP requests can be intercepted before redirection. |
| Content-Security-Policy (CSP) | Mitigates XSS and unauthorized data injection by restricting allowed execution sources. | default-src 'self'; script-src 'self' https:; object-src 'none'; | Missing CSP allows third-party inline scripts and injected payloads to execute freely in the browser. |
| X-Content-Type-Options | Prevents Internet Explorer and modern browsers from MIME-sniffing a response away from declared content-type. | nosniff | Can cause browsers to execute images or text files as executable JavaScript. |
| X-Frame-Options | Controls whether the page can be rendered in an <iframe>, <frame>, or <object>. | DENY or SAMEORIGIN (or frame-ancestors in CSP). | Omission allows attackers to overlay transparent clickjacking traps over payment or login buttons. |
| Referrer-Policy | Limits sensitive URL parameters from leaking to external referrers. | strict-origin-when-cross-origin | Default referrers can expose private session IDs, tokens, or personal search queries in outgoing headers. |
| Permissions-Policy | Restricts browser features like camera, microphone, geolocation, and payment APIs. | geolocation=(), camera=(), microphone=() | Compromised third-party scripts could silently invoke hardware APIs or request permissions. |
Real-World Attack Vectors & Security Implications
Cross-Site Scripting (XSS) Exploitation
When an attacker injects malicious JavaScript, a robust CSP blocks execution or prevents data exfiltration to unauthorized endpoints.
Clickjacking (UI Redressing)
An attacker embeds your authenticated page in an invisible iframe on a phishing site, tricking the victim into clicking legitimate buttons.
MIME Confused Script Execution
Browsers attempting to infer content types may treat uploaded text or image files containing malicious code as executable scripts.
Production Hardening & Configuration Snippets
Implement these hardening configurations on your web server or edge CDN to resolve security warnings and strengthen domain defense.
# In Nginx http or server context:
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https:; font-src 'self' https: data:; object-src 'none'; base-uri 'self';" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;# In Apache .htaccess or httpd.conf:
<IfModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
Header always set Content-Security-Policy "default-src 'self'; script-src 'self' https:; style-src 'self' https:; img-src 'self' data: https:; object-src 'none';"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>// In Cloudflare: Rules -> Transform Rules -> Modify Response Header
// Add Header:
// Strict-Transport-Security = "max-age=31536000; includeSubDomains; preload"
// X-Content-Type-Options = "nosniff"
// X-Frame-Options = "SAMEORIGIN"
// Referrer-Policy = "strict-origin-when-cross-origin"Frequently Asked Questions: Security Header Checker
Will adding Content-Security-Policy break my website?
If misconfigured, yes. CSP is powerful and will block scripts, styles, or iframes not explicitly whitelisted. It is best to test with Content-Security-Policy-Report-Only first to observe violations in browser console or report endpoints before enforcing.
What is HSTS Preloading and how do I qualify?
HSTS Preloading registers your domain directly into the hardcoded list maintained by Google Chrome, Firefox, Safari, and Edge. To qualify, your header must have max-age of at least 31536000 (1 year), includeSubDomains, preload, and be served over HTTPS.
Why is X-XSS-Protection deprecated?
Modern browsers (Chrome, Edge, Firefox) have removed the legacy XSS auditor because it introduced cross-site leak vulnerabilities. Modern security relies on Content-Security-Policy rather than X-XSS-Protection.
How do COOP and CORP protect against Spectre side-channel attacks?
Cross-Origin-Opener-Policy (COOP) and Cross-Origin-Resource-Policy (CORP) isolate your browsing context in a dedicated process, preventing malicious cross-origin pages from accessing window objects or measuring timing via SharedArrayBuffer.
Can security headers be configured at the CDN level?
Yes. Most CDNs including Cloudflare, Fastly, AWS CloudFront, and Akamai permit injecting HTTP security headers via edge transform rules without altering origin web server code.
Governing Standards & Protocols
- W3C Content Security Policy Level 3
- RFC 6797 — HTTP Strict Transport Security
- W3C Referrer Policy Working Group Recommendation
- OWASP Secure Headers Project Cheat Sheet
CelebJared Inspection Architecture & Neutrality Notice
All diagnostic scans performed on CelebJared.org inspect non-invasive public network signals. We enforce strict Server-Side Request Forgery (SSRF) filters preventing queries to RFC 1918 private subnets, cloud metadata services (169.254.169.254), loopback addresses (127.0.0.0/8), and reserved intranet TLDs. Results reflect public network state at scan time and do not constitute an exhaustive penetration test or financial guarantee.