Security Headers
Check whether your website is sending important HTTP security headers and identify browser security protections that may be missing.
HTTP security headers allow a website to tell browsers how certain content and functionality should be handled. Correctly configured headers can reduce exposure to several common classes of web security problems.
WebInspect analyzes the headers returned by your website and highlights important security controls that are present, missing or potentially in need of review.
Whenever your browser requests a webpage, the web server returns both the page content and a collection of HTTP response headers.
Some of these headers contain general information about the response. Others can establish security policies that browsers are expected to enforce.
For example, a website can use security headers to tell a browser to always use HTTPS, restrict where scripts can be loaded from, prevent the website from being embedded inside another website or control which browser capabilities a page can access.
These controls form an important additional layer of browser-side security.
WebInspect examines several commonly recommended HTTP security headers and browser security controls.
Content Security Policy, commonly known as CSP, allows a website to define which sources are permitted to provide scripts, styles, images and other resources.
A carefully designed CSP can provide an additional layer of protection against certain content-injection and cross-site scripting scenarios.
Simply having a CSP header does not automatically mean that the policy is secure. The directives and permitted sources also matter.
HTTP Strict Transport Security, or HSTS, instructs compatible browsers to access a website using HTTPS rather than an unencrypted HTTP connection.
HSTS can help protect users against protocol downgrade and certain HTTPS stripping scenarios.
The X-Content-Type-Options: nosniff header tells browsers not to guess the content type of a response when it differs from the declared MIME type.
This reduces security risks associated with MIME-type sniffing.
X-Frame-Options can restrict whether a page is permitted to load inside a frame.
This can help protect against clickjacking, where an attacker attempts to place a legitimate page inside another interface and trick a visitor into interacting with it.
Modern websites may also implement framing restrictions through the frame-ancestors directive in Content Security Policy.
Referrer-Policy controls how much information a browser includes in the Referer header when navigating between resources and websites.
A suitable policy can help reduce unnecessary disclosure of URL information.
Permissions-Policy allows websites to control access to selected browser features and capabilities.
Depending on the application, these may include features such as the camera, microphone, geolocation and other browser APIs.
Not necessarily.
A missing header is an indication that a particular browser security control is not being used. Whether that creates a meaningful security risk depends on the website, its functionality and the other protections already in place.
Security headers should therefore be evaluated in context rather than treated as a simple checklist.
WebInspect helps identify what is externally visible so that you can determine where further review or configuration may be appropriate.
Security headers can change unexpectedly.
Web server upgrades, reverse proxies, CDNs, application changes and configuration deployments can remove, replace or modify headers.
Checking them periodically can help identify configuration drift before it goes unnoticed for long periods.
WebInspect automatically examines HTTP security headers as part of its external website security inspection.
Run a free inspection to see which browser security controls your website currently exposes.