How to check any website's security headers in 30 seconds (and what each one does)

Goutham — Fri, 06 Nov 2026 05:15:24 +0000

Most small web apps ship without the HTTP headers that tell browsers how to protect their users. They take minutes to add, but nobody checks. Here's how to check yours, and what each header does.

Check them with curl

curl -sI https://yourapp.com

Look in the response for these six:

Header	What it does
`Content-Security-Policy`	Limits which scripts, styles and images may load, which limits the damage of XSS attacks
`Strict-Transport-Security`	Tells browsers to always use HTTPS for your domain
`X-Content-Type-Options: nosniff`	Stops browsers guessing file types (no running an upload as a script)
`X-Frame-Options` or CSP `frame-ancestors`	Stops other sites putting your page in an invisible frame (clickjacking)
`Referrer-Policy`	Controls how much of your URL leaks to other sites when people click links
`Permissions-Policy`	Turns off browser features you don't use (camera, microphone, location)

Or with a few lines of Node

const url = process.argv[2];
const res = await fetch(url, { redirect: 'follow' });
const h = res.headers;
const checks = {
  'Content-Security-Policy': h.has('content-security-policy'),
  'Strict-Transport-Security': h.has('strict-transport-security'),
  'X-Content-Type-Options': /nosniff/i.test(h.get('x-content-type-options') ?? ''),
  'X-Frame-Options': h.has('x-frame-options') || /frame-ancestors/i.test(h.get('content-security-policy') ?? ''),
  'Referrer-Policy': h.has('referrer-policy'),
  'Permissions-Policy': h.has('permissions-policy'),
};
for (const [name, ok] of Object.entries(checks)) console.log(ok ? '✓' : '✗', name);
console.log(`${Object.values(checks).filter(Boolean).length}/6`);

Run it with node check.mjs https://example.com. As of today, example.com scores 0/6.

Adding them on Vercel

{
  "headers": [{
    "source": "/(.*)",
    "headers": [
      { "key": "Strict-Transport-Security", "value": "max-age=63072000; includeSubDomains; preload" },
      { "key": "X-Content-Type-Options", "value": "nosniff" },
      { "key": "X-Frame-Options", "value": "DENY" },
      { "key": "Referrer-Policy", "value": "strict-origin-when-cross-origin" },
      { "key": "Permissions-Policy", "value": "camera=(), microphone=(), geolocation=()" }
    ]
  }]
}

Content-Security-Policy needs care, because a policy that's too strict breaks your own scripts. Start with Content-Security-Policy-Report-Only and tighten it from there.

Why I'm writing this

I kept forgetting these headers on my own projects, along with images that are too heavy and analytics that load before the cookie banner. So I'm building Sprigwork: AI teammates that find these problems with open-source scanners, write the fix in your code, and wait for your approval before anything changes. It's a desktop app, so your code stays on your machine.

The free glass check already works: paste a URL and it reports headers, trackers versus consent, and server response time → https://sprigwork.vercel.app/?utm_source=devto&utm_medium=article

What should I add to the check next?

DEV Community: Goutham

How to check any website's security headers in 30 seconds (and what each one does)

Check them with curl

Or with a few lines of Node

Adding them on Vercel

Why I'm writing this