Listen to this Post
Introduction:
HTTP security headers are critical directives sent by web servers that instruct browsers how to behave when handling your site’s content. Despite their importance, they remain one of the most neglected layers of web security—leaving applications vulnerable to XSS, clickjacking, MITM attacks, and information leaks. A new open-source tool called HeaderGuard scans and grades websites on their header configurations, revealing that even giants like google.com and cybersecurity platforms like PortSwigger.net receive failing grades due to missing or misconfigured headers.
Learning Objectives:
- Understand the role and security impact of key HTTP headers (CSP, HSTS, X-Frame-Options, etc.)
- Learn how to manually audit and programmatically grade security headers using command-line tools and Python
- Implement proper header configurations on Linux (Nginx/Apache) and Windows (IIS) to mitigate common web vulnerabilities
You Should Know:
1. Manual Header Auditing with Curl and PowerShell
Step‑by‑step guide to check HTTP security headers from any domain, interpret missing headers, and identify misconfigurations.
Linux / macOS (curl):
Check headers of a target (follow redirects) curl -I -L https://google.com Filter specific headers curl -s -I -L https://portswigger.net | grep -i "content-security-policy|strict-transport-security|x-frame-options" Test for HSTS max-age curl -s -I -L https://hackerone.com | grep -i "strict-transport-security"
Windows (PowerShell):
Basic header request
Invoke-WebRequest -Uri https://bugbase.in -Method Head | Select-Object -ExpandProperty Headers
Custom function to check multiple headers
$headers = @("Content-Security-Policy","Strict-Transport-Security","X-Frame-Options","X-Content-Type-Options")
$response = Invoke-WebRequest -Uri https://google.com -Method Head
foreach ($h in $headers) {
if ($response.Headers[$h]) { Write-Host "$h : $($response.Headers[$h])" -ForegroundColor Green }
else { Write-Host "$h : MISSING" -ForegroundColor Red }
}
What these commands do:
`-I` fetches only the HTTP response headers. `-L` follows redirects (critical because security headers may be set on the final destination, e.g., google.com → www.google.com). The absence of `Strict-Transport-Security` (HSTS) means the site is vulnerable to SSL-stripping MITM attacks. Missing `X-Frame-Options` allows clickjacking. `Content-Security-Policy` with `unsafe-inline` or `unsafe-eval` is considered weak and flagged by HeaderGuard.
2. Building a HeaderGuard‑Like Analyzer in Python (Flask)
Step‑by‑step guide to create your own HTTP security header grader with risk levels.
Core grading logic (Python):
import requests
from urllib.parse import urlparse
def grade_headers(url):
try:
resp = requests.get(url, timeout=10, allow_redirects=True)
headers = resp.headers
score = 100
findings = []
CSP check
csp = headers.get('Content-Security-Policy', '')
if not csp:
score -= 25
findings.append("Missing CSP → XSS risk")
elif "'unsafe-inline'" in csp or "'unsafe-eval'" in csp:
score -= 15
findings.append("CSP has unsafe-inline/eval → weak protection")
HSTS check
hsts = headers.get('Strict-Transport-Security', '')
if not hsts:
score -= 25
findings.append("Missing HSTS → MITM risk")
else:
import re
max_age = re.search(r'max-age=(\d+)', hsts)
if max_age and int(max_age.group(1)) < 15778800: 6 months
score -= 10
findings.append("HSTS max-age < 6 months → weak")
X-Frame-Options
xfo = headers.get('X-Frame-Options', '')
if not xfo:
score -= 20
findings.append("Missing X-Frame-Options → clickjacking risk")
elif xfo.upper() not in ['DENY', 'SAMEORIGIN']:
score -= 5
findings.append("X-Frame-Options misconfigured")
Info leak: Server, X-Powered-By
if headers.get('Server'):
findings.append(f"Server header exposes tech: {headers['Server']}")
score -= 10
if headers.get('X-Powered-By'):
findings.append(f"X-Powered-By leak: {headers['X-Powered-By']}")
score -= 5
grade = 'A+' if score >= 90 else 'A' if score >= 80 else 'B' if score >= 70 else 'C' if score >= 60 else 'D' if score >= 50 else 'F'
risk = 'Critical' if score < 40 else 'High' if score < 60 else 'Medium' if score < 80 else 'Low'
return grade, risk, findings
except Exception as e:
return 'Error', 'Unknown', [str(e)]
Example
print(grade_headers('https://google.com'))
Flask web endpoint (snippet):
from flask import Flask, request, jsonify
app = Flask(<strong>name</strong>)
@app.route('/scan', methods=['GET'])
def scan():
target = request.args.get('url')
grade, risk, issues = grade_headers(target)
return jsonify({'url': target, 'grade': grade, 'risk': risk, 'findings': issues})
if <strong>name</strong> == '<strong>main</strong>':
app.run(debug=True)
Deploy and test locally: `curl “http://127.0.0.1:5000/scan?url=https://hackerone.com”`
3. Hardening Your Web Server: Correct Header Configurations
Step‑by‑step configurations for Nginx (Linux) and IIS (Windows) to achieve an A+ grade.
Nginx (inside server block):
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; add_header X-Frame-Options "DENY" always; add_header X-Content-Type-Options "nosniff" always; add_header Content-Security-Policy "default-src 'self'; script-src 'self' https://trusted-cdn.com; object-src 'none'" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always; add_header Permissions-Policy "geolocation=(), microphone=()" always; Remove info-leak headers proxy_hide_header X-Powered-By; proxy_hide_header Server;
Apache (.htaccess or httpd.conf):
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" Header always set X-Frame-Options "DENY" Header always set X-Content-Type-Options "nosniff" Header set Content-Security-Policy "default-src 'self';" Header unset X-Powered-By Header unset Server
Windows IIS (PowerShell as Admin):
Add custom headers via IIS cmdlets
Add-WebConfigurationProperty -Filter "system.webServer/httpProtocol/customHeaders" -Name "." -Value @{name="X-Frame-Options";value="DENY"}
Add-WebConfigurationProperty -Filter "system.webServer/httpProtocol/customHeaders" -Name "." -Value @{name="X-Content-Type-Options";value="nosniff"}
Add-WebConfigurationProperty -Filter "system.webServer/httpProtocol/customHeaders" -Name "." -Value @{name="Strict-Transport-Security";value="max-age=31536000; includeSubDomains"}
Remove Server header (requires URL Rewrite module or custom module)
After applying, re-run the audit commands to confirm improvements.
- From Missing Headers to Exploits: Recon for Bug Bounty Hunters
Step‑by‑step guide on using header gaps as signals for deeper vulnerabilities.
Case 1 – No CSP = XSS hunting:
Missing CSP means the browser will execute any injected script. Use this as a green light to test all input vectors with payloads like <script>alert(1)</script>. Automate with dalfox:
dalfox url https://target.com/search?q=test --no-spinner
Case 2 – No HSTS = SSL stripping:
If HSTS is absent, an attacker on the same network can force HTTP requests. Check if the HTTP version of the site exposes sensitive endpoints:
Compare HTTP vs HTTPS responses curl -I http://target.com/login curl -I https://target.com/login
If both return 200, the HTTP endpoint may leak credentials.
Case 3 – No X-Frame-Options = Clickjacking:
Create a proof-of-concept HTML page:
<iframe src="https://target.com/account/delete" width="800" height="600"></iframe>
If the page loads inside the iframe, it’s vulnerable. Report with a crafted button overlay.
Case 4 – Info leak via Server header:
curl -I https://target.com | grep Server
If it returns Server: Apache/2.4.41 (Ubuntu), attackers can search for version-specific exploits (e.g., CVE-2021-40438 for Apache 2.4.41).
- Automating Header Audits with a Full Python Script (Cron/CI Ready)
A production‑ready script that scans a list of domains, generates a report, and outputs risk levels.
!/usr/bin/env python3
import csv
import requests
from urllib.parse import urlparse
def audit_bulk(domains_file, output_csv):
with open(domains_file, 'r') as f:
domains = [line.strip() for line in f if line.strip()]
results = []
for domain in domains:
url = f"https://{domain}" if not domain.startswith('http') else domain
try:
r = requests.get(url, timeout=10, allow_redirects=True)
headers = r.headers
score = 100
if not headers.get('Content-Security-Policy'): score -= 25
if not headers.get('Strict-Transport-Security'): score -= 25
if not headers.get('X-Frame-Options'): score -= 20
if not headers.get('X-Content-Type-Options'): score -= 10
grade = 'A+' if score >= 90 else 'A' if score >= 80 else 'B' if score >= 70 else 'C' if score >= 60 else 'D' if score >= 50 else 'F'
results.append([domain, grade, score, url])
except Exception as e:
results.append([domain, 'ERROR', 0, str(e)])
with open(output_csv, 'w', newline='') as csvfile:
writer = csv.writer(csvfile)
writer.writerow(['Domain', 'Grade', 'Score', 'Notes'])
writer.writerows(results)
print(f"Report saved to {output_csv}")
if <strong>name</strong> == "<strong>main</strong>":
audit_bulk('domains.txt', 'header_audit.csv')
Run weekly via cron (Linux) or Task Scheduler (Windows) to continuously monitor your own infrastructure.
What Undercode Say:
- Key Takeaway 1: HTTP security headers are not optional “nice-to-haves.” Missing CSP, HSTS, and X-Frame-Options directly enable XSS, MITM, and clickjacking—attack vectors that are routinely exploited in the wild. Tools like HeaderGuard expose how even security‑focused companies (PortSwigger) can score D grades on their main domains.
- Key Takeaway 2: A failing grade does not always indicate negligence; google.com scores F by design because its static marketing page contains no sensitive functionality. Context matters. However, for any application handling user data, payments, or authentication, strict headers are mandatory. Bug bounty hunters can use header gaps as powerful reconnaissance signals to prioritize injection testing and framing attacks.
- The Python+Flask implementation provided above can be extended to scan thousands of subdomains, integrated into CI/CD pipelines, or deployed as a microservice. Windows administrators are not left out—PowerShell offers equivalent capabilities for header inspection and IIS hardening. As API security grows, remember that headers like `Content-Security-Policy` also apply to API responses (e.g., preventing JSONP injection). The line between web and API security is blurring, and header hygiene remains a universal baseline.
Prediction:
Within two years, automated header grading will become a standard feature in cloud WAFs (AWS WAF, Cloudflare, Azure Front Door) and CI/CD security gates. Regulatory frameworks (PCI DSS v4.0 already mandates HSTS for certain environments) will expand to require CSP reporting and X-Frame-Options. Consequently, bug bounty programs will start treating missing headers as at least “low/medium” severity findings rather than informational, forcing organizations to prioritize hardening. The open-source momentum of tools like HeaderGuard will accelerate this shift, making header security as routine as SSL/TLS configuration.
▶️ Related Video (78% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Tanjot Singh – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
