Cybersecurity

HTTP header review

A free reading of the browser protections on one public page. Six controls. One letter.

This review reads the headers of one public response. The letter is not a penetration test, a certification, or a statement that the application is free of weaknesses.

Scope of this review

HTTPS persistence (Strict-Transport-Security) Tells the browser to stay on HTTPS.
Content policy (Content-Security-Policy) Limits where scripts and other content can load from.
Framing control (X-Frame-Options or frame-ancestors) Stops another site from embedding this page.
Content type lock (X-Content-Type-Options) Stops the browser from guessing the file type.
Referrer policy Limits the address sent when a visitor leaves.
Browser permissions (Permissions-Policy) Closes camera, microphone, location, and payment unless the page needs them.