Security Headers Analyzer

🧩 Technical Details

What this tool checks

• Presence and quality of high-impact security response headers.
• Policy coverage scoring for transport, framing, and content restrictions.
• Redirect-aware validation to detect posture loss on intermediate hops.

How to read the output

• Result Summary gives an at-a-glance posture score and risk class.
• Overview lists missing or weak headers with immediate priorities.
• Technical Details provides normalized header map per hop.
• Raw Output supports security review and release validation logs.

Common failure patterns

1. Missing HSTS or frame controls leaves known browser attack paths open.
2. CSP policy too permissive to meaningfully reduce script injection risk.
3. Header drift between origin and CDN causes inconsistent security behavior.
4. Redirect chains strip security headers before final destination.

Remediation workflow

1. Define baseline security headers at edge and enforce consistency.
2. Roll out stricter CSP in staged mode with reporting and tuning.
3. Align origin overrides with edge defaults to avoid conflict.
4. Re-test after each policy or routing deployment.

Next steps

• HTTP Response Header Viewer
• SSL and TLS Certificate Test
• Back to Web category