Security Headers Checker
Inspect HTTP response headers for CSP, HSTS, X-Frame-Options, and defensive browser policies.
Notice: This is a configuration-level security check, not a penetration test. It does not test internal network vulnerabilities or software application logic.
Inspect Domain Security Posture
Enter any public URL. Our scanner inspects HTTP/HTTPS headers to evaluate browser defense policies and transport encryption.
Header Security Breakdown
Target: https://github.com (42ms)
Restricts script injection sources and cross-site scripting (XSS) vectors.
Enforces HTTPS encryption and prevents SSL-stripping man-in-the-middle attacks.
Guards against clickjacking by disallowing unauthorized iframe embedding.
Stops browsers from MIME-sniffing responses away from the declared Content-Type.
Limits URL query parameter exposure when users click external links.
Disables unused browser hardware features (camera, mic, geolocation).
Remediation Configuration
Ready-to-deploy defensive headers for your reverse proxy or framework
// next.config.mjs
const securityHeaders = [
{ key: 'X-DNS-Prefetch-Control', value: 'on' },
{ key: 'Strict-Transport-Security', value: 'max-age=63072000; includeSubDomains; preload' },
{ key: 'X-Frame-Options', value: 'SAMEORIGIN' },
{ key: 'X-Content-Type-Options', value: 'nosniff' },
{ key: 'Referrer-Policy', value: 'origin-when-cross-origin' },
{ key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' },
];
export default {
async headers() {
return [{ source: '/:path*', headers: securityHeaders }];
},
};Security Assessment Summary
Security Headers Grade: A+ (100/100)
HTTP security posture evaluated at Grade A+ (100/100). Checked 6 primary defensive headers with 0 findings identified.
Değerlendirme Boyutları
Önemli teknik ve operasyonel faktörler genelinde ağırlıklı analiz
CSP header configured.
HSTS header configured.
X-Frame-Options configured.
nosniff directive active.
Referrer and Permissions policy evaluations.
Teşhis Bulguları
Otomatik mimari, ekonomik ve teknik gözlemler
Bu Kategoride Bulgu Yok
Girdi parametreleri yüksek mimari veya ekonomik risk işareti tetiklemedi.
Apply Standard Defensive HTTP Response Headers
Implement the recommended baseline configuration in your application gateway or reverse proxy.
Öncelikli Uygulama Adımları
- Add Strict-Transport-Security with a 1-year max-age and includeSubDomains.
- Set X-Content-Type-Options: nosniff and X-Frame-Options: SAMEORIGIN.
- Define a restrictive Content-Security-Policy starting in report-only mode if necessary.
- Strip X-Powered-By and server version disclosures from response headers.
Need a comprehensive application security & cloud infrastructure audit?
Robonom conducts enterprise penetration testing, API vulnerability assessments, and infrastructure hardening for mission-critical web applications.
Sıkça Sorulan Sorular
What is the purpose of HTTP Security Headers?
Security headers instruct visitor web browsers how to handle authentication tokens, restrict script injection, prevent clickjacking, and enforce HTTPS encryption, hardening your web application before malicious requests reach server logic.
Why does Content-Security-Policy (CSP) have the highest weight in this audit?
CSP is the web platform's most powerful defensive mechanism against Cross-Site Scripting (XSS) and data exfiltration. Without a CSP, any compromised third-party script or ad network can execute arbitrary code inside your visitor's authenticated session.
Is this audit a full web application penetration test?
No. This is a configuration-level security check evaluating defensive HTTP response headers. It does not probe application endpoints, execute exploits, test SQL injection, or replace a manual penetration test.
İlgili Teşhis Araçları
Sürecinizi doğrulamak için önerilen sıralı analizler