How to check any website's security headers in 30 seconds (and what each one does)
Most small web apps ship without the HTTP headers that tell browsers how to protect their users. They take minutes to add, but nobody checks. Here's how to check yours, and what each header does. Check them with curl curl -sI https://yourapp.com Look in the response for these six: Header What it does Content-Security-Policy Limits which scripts, styles and images may load, which limits the damage…
To determine if a website has the proper security headers in place, you can easily check them using just a few commands. First, open up a terminal and use the curl command followed by -sI and the website's URL. This will show you the response headers. In those headers, look for six key security headers:
Content-Security-Policy, which restricts which scripts, styles, and images can be loaded, limiting the impact of cross-site scripting (XSS) attacks;
Strict-Transport-Security, which instructs browsers to always use HTTPS for your domain, preventing plain HTTP from being used;
X-Content-Type-Options, set to "nosniff" to prevent browsers from guessing file types, stopping potential script execution;
X-Frame-Options or CSP frame-ancestors, which prevent other sites from embedding your page in an invisible frame (clickjacking);
Referrer-Policy, which controls how much of your URL is leaked to other sites when users click links;
Permissions-Policy, which turns off browser features you don't use, like the camera, microphone, or location services.
Alternatively, you can run a short Node.js script by providing the website's URL as a command line argument. This script fetches the page, checks for the presence of each header, and logs whether each header is present or not. As of now, the website example.com fails to score any headers out of the six basic ones. To improve security on platforms like Vercel, you can add headers in the application's configuration file.
For Content-Security-Policy, start with a cautious approach, using the Content-Security-Policy-Report-Only mode to catch potential issues without blocking your own scripts. Gradually tighten the policy as you identify safe sources.
Implementing these headers is crucial, as many developers tend to overlook them. Sprigwork, a desktop app in development, aims to automate this process. It uses AI teammates to scan your code, suggest the necessary security headers, and wait for your approval before making any changes. This ensures your code remains on your machine, enhancing security without external dependencies.
You can try the free glass check by pasting a URL on https://sprigwork.vercel.app/?utm_source=devto&utm_medium=article. Consider what other features you might want to add to enhance this security checker.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
