An HTTP security header audit is useful when it shows what a server actually returned, explains what that means for the application, and gives the client a proportionate fix they can verify. A scanner score alone cannot establish whether a policy is suitable. Assess representative routes and response types, document the evidence and limits of the sample, then connect each finding to impact, priority, action, and a concrete retest.
Define what the audit covers
Before checking headers, agree on the hosts, environments, routes, and response types in scope. A homepage scan is a starting signal, not evidence that every endpoint or status code behaves the same way. OWASP’s guidance on secure-header verification tools notes the scope limitation of tools that inspect only the homepage.
As an Amazon Associate I earn from qualifying purchases.
Record whether the sample includes public and authenticated pages, redirects, errors, downloads, APIs, and responses containing user-provided files. Note known subdomains and third-party integrations where relevant. State exclusions clearly so the report does not imply checks were performed on routes that were not examined.
- Which hostnames and environments were tested?
- Which representative routes and response classes were included?
- Were authenticated routes accessible to the auditor?
- Were redirects and error responses checked, as well as successful responses?
- What was excluded, and why?
OWASP’s ASVS 4.0.3 HTTP security headers criteria frames these checks at the response level. That is why a single result should not be generalized to the whole application.
#1 Best Overall
Capture response evidence route by route
For each sampled response, preserve the URL or route, status code, redirect behavior, content type, relevant headers, environment, and capture date. Record the actual header value—or its absence—rather than only a scanner grade. If access or tooling limits the sample, describe exactly what was visible and checked.
Automated tools can speed up collection, but manual inspection and application context are needed to assess whether a policy fits the route. OWASP’s verification guidance describes header inspection tools; the existence of a tool does not establish that its findings are accurate for every application or that its policy recommendations are appropriate.
Interpret headers in light of the response. Browser policies such as CSP matter most for pages that load or interpret scripts and other code; a JSON API response may have no use for HTML-oriented policy headers. Check that Content-Type correctly identifies the response, and assess X-Content-Type-Options: nosniff separately: it tells browsers to respect the declared media type instead of guessing. OWASP’s HTTP Headers Cheat Sheet covers these controls and their context.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Assess each header by its job
Content-Security-Policy
CSP constrains which sources a browser may load or execute. Judge the observed directives against the application’s legitimate scripts, styles, frames, and other resources; a generic policy can either leave gaps or break expected behavior. OWASP describes CSP as complex to configure and maintain in its Content Security Policy Cheat Sheet.
When introducing or tightening a policy, first send Content-Security-Policy-Report-Only and investigate violations without blocking the page. Distinguish legitimate dependencies from unexpected sources, adjust the policy, and enforce it after validation. Prefer the HTTP response header: OWASP says it supports the full CSP feature set, while delivery through a meta element lacks some capabilities. See the OWASP Web Security Testing Guide’s CSP testing guidance.
Strict-Transport-Security
HSTS tells browsers to access a site over HTTPS. Before recommending a long duration or includeSubDomains, verify that HTTPS and valid certificates work for every affected host. The directive extends the policy to subdomains, so it can affect services beyond the primary site. Treat preload as a consequential deployment decision, not a casual switch. OWASP explains the scope and rollout considerations in its HTTP Strict Transport Security Cheat Sheet.
Rank #3
Framing controls
CSP’s frame-ancestors is OWASP’s modern control for deciding which sites may frame a page; X-Frame-Options can still matter for older-browser compatibility. Determine whether the response contains interactive content that could be framed and whether the product has a legitimate embedding requirement before proposing a restriction.
Referrer-Policy
Assess which referrer information the browser sends and whether that behavior fits the site’s privacy needs and integrations. A change that reduces disclosure may also affect services that rely on referrer information, so tie the recommendation to observed product behavior.
Cache-Control
For sensitive responses, establish whether private or shared caching is appropriate. Do not treat no-cache as equivalent to no-store: OWASP notes that no-cache permits storage but requires revalidation. Apply the directive to the relevant response class rather than assuming every route has the same sensitivity.
Permissions-Policy and cross-origin behavior
Evaluate which browser features and cross-origin resources the application actually uses. A broad copied policy or a CORS value such as * may conflict with endpoint requirements; assess the route, resources, and access model before recommending a change.
Server-identifying and obsolete headers
Server and X-Powered-By disclose technology details but are not protective headers themselves. Minimizing them can reduce unnecessary disclosure, though removal does not prevent other forms of fingerprinting. Do not report a missing legacy X-XSS-Protection, Expect-CT, or HPKP header as a defect that needs remediation: OWASP advises against deploying these obsolete controls. These distinctions are covered in the OWASP HTTP Headers Cheat Sheet.
Write findings clients can act on
Use the same structure for each finding so the client can understand both the evidence and the next step. Separate a confirmed weakness from a hardening opportunity or a control that does not apply to that response.
Best Value
- Finding and priority: Give the issue a plain-language name and explain the priority briefly in terms of exposure, data sensitivity, exploitability, affected routes, and implementation risk.
- Where observed: Identify the route or response class, environment, status code, and date of capture.
- Evidence: Include the relevant header and exact observed value, or state that it was absent from the sampled response.
- Meaning: Explain the browser behavior and realistic risk for this application. Do not call the whole site insecure solely because one header was missing.
- Recommended change: State the policy-level change while accounting for required application behavior. Name the serving layer only if it is known; otherwise ask the client to confirm where the response is configured.
- Caveat and validation: Note relevant compatibility, subdomain, third-party, or deployment concerns, then define the route and expected response to check after the change.
A present header is not automatically correct: a permissive CSP may provide little protection, while an overly restrictive one can break legitimate resources. Similarly, whether a cross-origin policy is appropriate depends on the endpoint, not on a scanner’s grade alone.
Prioritize, retest, and state the limits
Prioritize findings using the affected routes’ exposure and data sensitivity, the control’s practical effect, and the likelihood and scope of disruption from a change. Separate urgent defects from lower-priority improvements and controls that do not apply to the sampled response.
After remediation, repeat the same checks on the same routes and response classes. Compare captured header values, status codes, and content types; record any remaining exceptions. If the sample revealed no issue, report the sample and its limits rather than claiming every response was verified.
Recommended Free Tools
Compare audit approaches without relying on a score
When a client is choosing how to inspect headers, compare the method’s coverage and evidence—not just its summary rating. OWASP’s secure-header verification page lists inspection options, but it does not establish comparative accuracy or value for individual tools.
- Does it check only a homepage, or can it inspect the required routes, redirects, and errors?
- Can it reach authenticated responses, or is its view limited to public pages?
- Does it report presence only, or help assess policy quality and application context?
- Can findings be repeated and exported with the observed response values?
- Does it explain impact and priority, and can the same routes be retested after a fix?
Use automated collection to support a repeatable audit, then verify important findings against the response and the application’s requirements. The report should let a client trace each recommendation back to evidence and understand what success looks like on retest.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
