Security Headers Checker
Inspect HTTP response headers for CSP, HSTS, X-Frame-Options, and security flags protecting your web traffic.
Notice: This is a configuration-level security check, not a penetration test. It does not test internal network vulnerabilities or software application logic.
Inspect Domain Security Posture
Enter any public URL. Our scanner inspects HTTP/HTTPS headers to evaluate browser defense policies and transport encryption.
Header Security Breakdown
Target: https://github.com (42ms)
Restricts script injection sources and cross-site scripting (XSS) vectors.
Enforces HTTPS encryption and prevents SSL-stripping man-in-the-middle attacks.
Guards against clickjacking by disallowing unauthorized iframe embedding.
Stops browsers from MIME-sniffing responses away from the declared Content-Type.
Limits URL query parameter exposure when users click external links.
Disables unused browser hardware features (camera, mic, geolocation).
Remediation Configuration
Ready-to-deploy defensive headers for your reverse proxy or framework
// next.config.mjs
const securityHeaders = [
{ key: 'X-DNS-Prefetch-Control', value: 'on' },
{ key: 'Strict-Transport-Security', value: 'max-age=63072000; includeSubDomains; preload' },
{ key: 'X-Frame-Options', value: 'SAMEORIGIN' },
{ key: 'X-Content-Type-Options', value: 'nosniff' },
{ key: 'Referrer-Policy', value: 'origin-when-cross-origin' },
{ key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' },
];
export default {
async headers() {
return [{ source: '/:path*', headers: securityHeaders }];
},
};Security Assessment Summary
Security Headers Grade: A+ (100/100)
HTTP security posture evaluated at Grade A+ (100/100). Checked 6 primary defensive headers with 0 findings identified.
Evaluation Dimensions
Weighted assessment across key technical and business factors
CSP header configured.
HSTS header configured.
X-Frame-Options configured.
nosniff directive active.
Referrer and Permissions policy evaluations.
Diagnostic Findings
Automated architectural, economic, and technical observations
No Findings in this Category
The input parameters do not trigger high architectural or economic risk flags.
Apply Standard Defensive HTTP Response Headers
Implement the recommended baseline configuration in your application gateway or reverse proxy.
Immediate Execution Milestones
- Add Strict-Transport-Security with a 1-year max-age and includeSubDomains.
- Set X-Content-Type-Options: nosniff and X-Frame-Options: SAMEORIGIN.
- Define a restrictive Content-Security-Policy starting in report-only mode if necessary.
- Strip X-Powered-By and server version disclosures from response headers.
Need a comprehensive application security & cloud infrastructure audit?
Robonom conducts enterprise penetration testing, API vulnerability assessments, and infrastructure hardening for mission-critical web applications.
Frequently Asked Questions
What is the purpose of HTTP Security Headers?
Security headers instruct visitor web browsers how to handle authentication tokens, restrict script injection, prevent clickjacking, and enforce HTTPS encryption, hardening your web application before malicious requests reach server logic.
Why does Content-Security-Policy (CSP) have the highest weight in this audit?
CSP is the web platform's most powerful defensive mechanism against Cross-Site Scripting (XSS) and data exfiltration. Without a CSP, any compromised third-party script or ad network can execute arbitrary code inside your visitor's authenticated session.
Is this audit a full web application penetration test?
No. This is a configuration-level security check evaluating defensive HTTP response headers. It does not probe application endpoints, execute exploits, test SQL injection, or replace a manual penetration test.
Related Diagnostic Tools
Recommended sequential assessments to validate your workflow