Security Headers: What Is This Site Actually Protecting Against?
Using curl and browser DevTools to check for HSTS, CSP, and other security headers.
Tools required: curl
Overview
Security headers are instructions a website sends to the browser about how to handle it safely - whether to force HTTPS, whether to allow the page in a frame, and more. Missing headers aren't usually an outage, but they are a real, checkable security gap.
Step-by-Step Manual Check
Pull the full set of response headers
The response headers a server sends contain every security instruction it's giving the browser - or reveal that it's giving none at all.
curl -I https://example.com-I sends a HEAD request and shows only the headers, no page body.
Healthy result
HTTP/2 200 strict-transport-security: max-age=31536000; includeSubDomains content-security-policy: default-src 'self' x-content-type-options: nosniff x-frame-options: DENY referrer-policy: strict-origin-when-cross-origin
Problem result
HTTP/2 200 content-type: text/html (no security-related headers present at all)
What it means
A completely healthy site shows all six major security headers. Seeing HTTP/2 200 with none of them isn't a broken site - the site works fine for visitors - but it means the server admin has never configured these protections.
If unresolved, escalate to: Level 2 — Intermediate
Check for each specific header individually
Filtering the output makes it easy to confirm exactly which headers are present versus missing, one at a time.
curl -sI https://example.com | grep -i "strict-transport-security\|content-security-policy\|x-frame-options\|x-content-type-options\|referrer-policy\|permissions-policy"On Windows PowerShell, use: curl.exe -sI https://example.com | Select-String "strict-transport|content-security|x-frame|x-content-type|referrer-policy|permissions-policy"
Healthy result
All 6 lines print, one per header, with sensible values (e.g. max-age > 0, a real CSP policy, DENY or SAMEORIGIN).
Problem result
Only 2-3 lines print, or the command returns nothing at all.
What it means
Missing HSTS = the site never tells returning browsers to force HTTPS, leaving a window for downgrade attacks. Missing X-Frame-Options and missing frame-ancestors in CSP together = the page can be embedded in a hidden iframe on another site (clickjacking). Missing X-Content-Type-Options = the browser may guess file types in a way that helps attackers.
If unresolved, escalate to: Level 2 — Intermediate
Cross-check visually in browser DevTools
Useful for showing a non-technical stakeholder exactly what's missing, and confirms the header set the real visitor's browser actually received.
F12 > Network tab > click the main document request > Headers tab > Response Headers sectionHealthy result
All configured security headers listed under Response Headers, matching what curl showed.
Problem result
Response Headers section is short, missing the same headers curl reported as absent.
What it means
This confirms the gap is real and not a curl-specific artifact (e.g. some CDNs behave slightly differently for HEAD vs GET requests) - if DevTools agrees with curl, the finding is solid.
If unresolved, escalate to: Level 1 — Basic
Interpreting the Results
A missing security header is never the cause of a site being down - it's a hardening gap, not an outage. Prioritize by risk: missing HSTS and missing frame protections (X-Frame-Options/CSP frame-ancestors) are the ones worth fixing first since they enable active attacks; missing Permissions-Policy is lower priority.
Common Causes
| Symptom | Likely Cause | Fix |
|---|---|---|
| No security headers at all | Server/CDN was never configured to send them - this is the default state for most frameworks unless explicitly set | Add the headers at the CDN/reverse-proxy layer or in application middleware. |
| HSTS present but max-age is very short (e.g. a few minutes) | A test/placeholder value was never updated for production | Set max-age to at least 31536000 (1 year) once HTTPS is confirmed stable. |
| CSP present but breaks page functionality (blocked scripts/styles) | Policy is too strict for the site's actual resource origins | Audit blocked-resource console warnings and add the specific required origins to the policy. |
Automated by
Diagnostic Suite - Site Latency Diagnostic (Option 2)
Automatically checks all six header categories and produces a security score - this exact check, done for you.