Urgent.News

What's breaking now, across thousands of outlets.

Sunday, 25 October 2026 Reading Room

Tech

Check security headers for a list of websites in Python: HSTS, CSP, X-Frame-Options and an A-F grade (2026)

Security headers are the cheapest hardening a website can get: a handful of response headers that tell the browser to stay on HTTPS, refuse to run injected scripts, refuse to be framed by another site and stop guessing content types. They're also easy to forget, and they quietly disappear when someone swaps a CDN, a load balancer or a framework. Checking one site by hand is fine ( curl -sI…

dev.to ·

Security headers are essential for securing a website, providing a few response headers that instruct the browser to maintain HTTPS, prevent injected scripts, refrain from framing other sites, and stop guessing content types. These headers can easily be overlooked and vanish when a CDN, load balancer, or framework is changed. Checking a single site manually is feasible, but reviewing an entire client list, including all subdomains or numerous prospects, becomes challenging.

This script addresses this issue by accepting a list of URLs and providing a comprehensive report for each one, including the final URL after redirects, an A-F grade, a 0-100 score, and a plain-English description of any missing security features. The script investigates several headers, such as Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy, and assigns a score based on their presence and configuration.

A final score of 90 or higher indicates an A grade, 75 or higher a B grade, 60 or higher a C grade, 45 or higher a D grade, and anything below an F grade.

Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.

Read the original at dev.to →

More in Tech

Google Trends API in Python (2026): pytrends, 429 errors, and comparing keywords at scale

Google Trends is still one of the few free signals for "what are people searching for, relatively". But if you try to use it from code, you quickly run into three problems: There is no generally…

  • Google Trends lacks an official API, causing developers to face challenges
  • pytrends library wraps internal endpoints but has limitations like 5 keywords per request
  • pytrends users encounter 429 errors due to Google's rate limiting

·dev.to

A U.S. solar or battery generator that slips one month is a little more likely to start next month than a new one

EIA's monthly generator inventory, EIA-860M, lists generators planned to start next month. Fewer than four in ten of them are listed as operating in that month now.

  • One-month delay in solar generators increases start-up likelihood by 40%
  • Two-or-three-month delay in solar generators reduces start-up likelihood to 27%
  • Gas generators more likely to be delayed by one month compared to solar and wind

·dev.to

Approval is theater if code runs before the gate

Here is a nasty one. A malicious .git/config can execute when a coding agent merely gathers context — before any approval exists, before the agent does anything you would call an action.

  • Malicious .git/config file executes before approval
  • Eight vulnerabilities identified, four unpatched as of September 1
  • Sentinel inspects agent input before processing to prevent attacks

·dev.to

How Browser-Based WebAssembly Scans Encrypted WiFi QR Codes Without Server Uploads

Connecting to guest Wi-Fi networks in hotels, cafes, and offices has become ubiquitous through Wi-Fi QR codes. However, standard smartphone cameras often parse these codes silently without displaying…

  • Browser-based WebAssembly decodes encrypted Wi-Fi QR codes client-side.
  • Eliminates need to upload image data to remote servers, preventing credential leakage.
  • In-memory decoding reduces latency and bandwidth overhead compared to cloud-based methods.

·dev.to

Article 50 fines: what Article 99 sets and who enforces it

This guide was drafted by an AI agent from the primary sources linked at the bottom, and has not been reviewed by a lawyer. It is general information, not legal advice.

  • Article 50 sets maximum fine of EUR 15 million or 3% of annual turnover.
  • National market surveillance authorities enforce fines, following guidelines.
  • Smaller companies subject to lower of fixed amount or 3% of turnover.

·dev.to

More from Sunday 25 October →