Website Security Headers Checker

Website Security Headers Checker & Audit Engine

An enterprise-grade, high-throughput HTTP security headers, cookie flags, CORS configuration, and information disclosure analyzer with calibrated A+ to F grading, W3C CSP Level 3 AST checks, RFC 6797 HSTS preload validation, and RFC 9116 security.txt discovery for BrowserMesh.

Audits web applications against Cross-Site Scripting (XSS), clickjacking, SSL stripping, session hijacking, Spectre microarchitectural side-channels, and backend technology leakage using ultra-fast native HTTP inspection with automatic Playwright stealth browser escalation when protected by Cloudflare Turnstile, DataDome, or enterprise Web Application Firewalls (WAF).

The premier high-speed, concurrent alternative to SecurityHeaders.com (Scott Helme), Mozilla HTTP Observatory 2.0, Snyk CLI, and single-threaded curl scripts.

---

🎯 Target Audience & Industry Solutions

• DevSecOps & CI/CD Security Engineers: Integrate automated security header verification into continuous integration and deployment pipelines to enforce strict baseline compliance thresholds (e.g., fail deployment builds if the security score drops below 'A' or if Content-Security-Policy is omitted).
• Compliance & Security Auditing Officers: Benchmark external public web endpoints against ISO/IEC 27001, SOC 2 Type II, HIPAA, and PCI-DSS v4.0 Requirement 6.4 (public-facing web application defensive configurations).
• Web Application Penetration Testers & Bug Bounty Hunters: Rapidly discover missing defensive headers, insecure cookie attributes (missing HttpOnly/Secure), dangerous CORS wildcards with credentials, legacy deprecated headers, and server version fingerprint disclosures during black-box reconnaissance.
• Technical SEO Directors & Webmasters: Safeguard organic domain trust, eliminate browser mixed-content warnings, verify strict HTTPS pinning, and ensure modern browser privacy standards (Referrer-Policy: strict-origin-when-cross-origin) are enforced across all canonical pages.
• Vendor Risk Management & Portfolio Security Analysts: Concurrently scan hundreds of third-party SaaS vendors, agency client sites, or portfolio domains in parallel (up to 25 concurrent workers) to benchmark external cybersecurity hygiene without getting rate-limited.

---

🚀 Key Features

1. 12-Header Deep Evaluation Architecture

Evaluates defensive headers against modern W3C, RFC, and OWASP 2026 security guidelines:

• Strict-Transport-Security (HSTS, RFC 6797): Validates TLS transport pinning, evaluates max-age duration, checks includeSubDomains, and tests eligibility prerequisites for Chrome/Firefox HSTS preload submission (hstspreload.org). Actively warns against dangerous max-age=0 cache purges.
• Content-Security-Policy (CSP Level 3 & Trusted Types Baseline): Parses AST directives, flags dangerous 'unsafe-inline' and 'unsafe-eval' script sources, validates cryptographic nonces (nonce-...) and hashes (sha256-...), audits DOM XSS sink controls (require-trusted-types-for 'script'), and checks non-inheriting fallback directives (form-action, base-uri, object-src).
• X-Frame-Options (XFO) & CSP frame-ancestors: Enforces modern browser precedence rules where CSP frame-ancestors overrides X-Frame-Options. Detects obsolete ALLOW-FROM directives and flags clickjacking vulnerabilities.
• X-Content-Type-Options (Fetch Standard): Confirms nosniff enforcement to stop MIME-sniffing attacks that trick browsers into executing user-uploaded assets as HTML or JavaScript.
• Referrer-Policy (W3C Standard): Evaluates token fallback chains (last recognized token wins), flags privacy-leaking policies (unsafe-url, no-referrer-when-downgrade), and confirms secure defaults (strict-origin-when-cross-origin).
• Permissions-Policy (W3C Permissions Registry): Parses structured header syntax to verify that privileged browser APIs and hardware sensors (camera, microphone, geolocation, browsing-topics, clipboard-read, payment) are restricted from unauthorized iframe execution.
• Cross-Origin Isolation Triad (Spectre Mitigation): Validates COOP (same-origin), COEP (require-corp or credentialless), and CORP (same-origin/same-site) required for SharedArrayBuffer access, high-precision performance timers, and WebAssembly multi-threading.
• Origin-Agent-Cluster (W3C HTML Standard): Inspects Origin-Agent-Cluster: ?1 to verify process-level memory isolation and neutralization of legacy document.domain security relaxations.
• Set-Cookie Security & CHIPS Partitioning (RFC 6265bis): Audits Secure, HttpOnly, SameSite (Strict, Lax, None), CHIPS Partitioned, and __Host- / __Secure- prefix compliance across all redirect hops with intelligent deletion exemptions (Max-Age=0 / epoch expiration).
• Clear-Site-Data (W3C Standard): Validates standard double-quoted types ("cache", "cookies", "storage", "executionContexts", "clientHints", "*") served over secure TLS contexts.
• Information Disclosure Removal: Flags server banners (Server, X-Powered-By, X-AspNet-Version, X-Served-By, X-Varnish, X-Generator) that expose software builds and technology versions to automated exploit scanners.
• RFC 9116 security.txt Probing: Actively probes /.well-known/security.txt, guards against Single Page Application (SPA) catch-all HTML routes, validates unexpired RFC 3339 expiration timestamps, and extracts security contact channels.

2. Calibrated 0–100 Scoring Model with Hard Security Ceilings

Adopts an objective grading rubric calibrated from Mozilla HTTP Observatory 2.0 and OWASP criteria:

• Baseline Available Points: 115 points across 12 weighted categories.
• Hard Security Ceilings (Enforcing Real-World Security):
  • Missing HSTS on HTTPS: Score capped at 79 (Maximum Grade B).
  • Missing CSP: Score capped at 79 (Maximum Grade B).
  • Missing both HSTS and CSP: Score capped at 69 (Maximum Grade C).
  • Insecure Session Cookie (missing Secure over HTTPS): Score capped at 65 (Maximum Grade C).
  • Critical CORS reflection with credentials (* or reflected origin + Allow-Credentials: true): Score capped at 50 (Maximum Grade D).
• Standard Letter Grades:
  • A+ (90–100): Exceptional Security Posture (HSTS preloaded, strict nonced CSP, complete sensor lockdown).
  • A (80–89): Strong Security Posture (Full HSTS and CSP protection with minor non-critical omissions).
  • B (70–79): Adequate Security Posture (Core protections in place; missing secondary headers).
  • C (60–69): Moderate Security Deficiencies (Missing HSTS or CSP; basic frame options present).
  • D (40–59): Poor Security Posture (Multiple critical defensive controls omitted).
  • E (20–39): Critical Security Deficiencies (Virtually no defensive perimeter; vulnerable to XSS and clickjacking).
  • F (0–19): Failing / Zero Protection (Unprotected transport or complete absence of defensive controls).

3. Smart Dual-Engine Execution (auto / http / browser)

• HTTP Mode: Pure native Node.js fetch pipeline with manual redirect chain tracing (capturing cookies across all hops) and sub-200ms response evaluation.
• Browser Mode: Full Playwright stealth Chromium execution (CloakBrowser) for client-hydrated single-page applications and JavaScript-injected headers.
• Auto Mode (Default): Executes lightning-fast native HTTP checks first; automatically escalates to stealth Chromium if the endpoint returns a Cloudflare Turnstile, DataDome, or WAF challenge block (HTTP 403/503).

4. Active CORS & RFC 9116 Probes

• Dynamic Origin Reflection Probe: Dispatches an active probe request with a foreign probe origin (Origin: https://browsermesh-probe.invalid) to verify whether the backend reflects arbitrary origins alongside Access-Control-Allow-Credentials: true.
• SPA Catch-All Protection for security.txt: Validates that /.well-known/security.txt returns text/plain rather than returning an HTML landing page from a React/Vue catch-all route, preventing false positives.

---

📊 Comparison with Alternative Solutions

---

⚙️ Configuration Parameters (schema.ts)

---

📋 Output Fields Reference (32 Structured Fields)

Every audit record strictly emits the following 32 structured fields conforming to the BrowserMesh unified QA schema:

---

💡 Best Practices for Enterprise Security Audits

1. Deploy in CI/CD Pre-Release Pipelines: Run the checker against staging URLs before major production releases. Set build gates to automatically reject deployments with grades below B or with missing form-action CSP directives.
2. Prioritize Hard Security Ceilings First: A site with a score of 79 capped due to missing HSTS or CSP can quickly jump to 90+ (A+) simply by configuring Strict-Transport-Security: max-age=31536000; includeSubDomains; preload and establishing a baseline CSP.
3. Migrate from X-Frame-Options to CSP frame-ancestors: While X-Frame-Options: DENY is widely supported, it cannot allow multiple embedding origins or selective paths. Modernize to Content-Security-Policy: frame-ancestors 'self' https://trusted-partner.com.
4. Enforce __Host- Cookie Prefixes for Session Tokens: Standardize session cookies to __Host-session_id=...; Secure; Path=/; SameSite=Lax. Browsers will strictly reject this cookie if served over HTTP or if subdomains attempt to overwrite it.
5. Always Suppress Server Technology Banners: Configure your reverse proxy (Nginx server_tokens off;, Apache ServerTokens Prod, or Cloudflare Workers) to strip Server and X-Powered-By headers, preventing automated vulnerability scanners from mapping software versions.

---

❓ Frequently Asked Questions (FAQ)

Q: How does the plugin handle Cloudflare Turnstile or 403 challenge pages?

In scrapeMode: "auto" (the default), if a target host returns HTTP 403 or 503 with Cloudflare or DataDome challenge headers (cf-ray, cf-mitigated, x-datadome), the checker automatically escalates the audit to a stealth Playwright Chromium instance (CloakBrowser). The browser loads the challenge, captures the true post-clearance wire response headers, and returns an accurate evaluation.

Q: Why is my website score capped at 79 even though all other headers are present?

The plugin enforces Hard Security Ceilings. If a website is served over HTTPS but completely lacks Strict-Transport-Security (HSTS) or lacks Content-Security-Policy (CSP), its score is capped at 79 (Grade B). Transport security and injection mitigation are critical baselines; without them, secondary headers cannot compensate.

Q: Does CSP frame-ancestors override X-Frame-Options?

Yes. According to W3C CSP Level 2 and Level 3 specifications, if a response contains both X-Frame-Options and Content-Security-Policy: frame-ancestors ..., all modern browsers ignore X-Frame-Options and enforce frame-ancestors. The plugin recognizes this precedence and awards full clickjacking protection credit under enforcedVia: "csp_frame_ancestors".

Q: How does the plugin test RFC 9116 security.txt without getting tricked by SPA catch-alls?

Many modern Single Page Applications (Next.js, Vue, Angular) configure wildcard routing that returns HTTP 200 OK with an HTML page for any non-existent path. The checker verifies that /.well-known/security.txt explicitly returns a non-HTML Content-Type (such as text/plain) and validates that the file body contains mandatory RFC 9116 fields (Contact: and unexpired Expires:).

Q: What is the difference between Strict-Transport-Security and HSTS Preloading?

Standard HSTS protects visitors only after their browser has visited the site over HTTPS at least once ("Trust on First Use"). HSTS Preload (preloadEligible: true) means the domain meets the criteria (max-age >= 31536000, includeSubDomains, and preload) to be hardcoded directly into Chrome, Firefox, Safari, and Edge binaries, ensuring browsers never connect over plain HTTP even on the very first visit.

Q: Are intentional cookie deletions penalized?

No. When an application logs out a user or clears state, it sends a Set-Cookie header with Max-Age=0 or an expiration date in the past. The plugin detects these deletion directives (isDeletion: true) and exempts them from security flag penalties (HttpOnly, SameSite), preventing false warnings.