"Checks every security header against best practices — CSP, HSTS, X-Frame-Options, and more."
HTTP security headers are the browser's first line of defense against attacks like clickjacking, cross-site scripting, and protocol downgrade. They're also one of the most commonly misconfigured and overlooked security controls. A missing Content-Security-Policy header enables XSS. A missing X-Frame-Options header enables clickjacking. Missing HSTS allows attackers to force HTTP connections.
Security Headers fetches each target and grades every security header against OWASP and industry best practices. Missing headers, misconfigured values, and dangerous settings all become findings with clear severity ratings.