Catalog/CONFIGURATION/security-headers
SCAN-ID: SECURITY-HEADERSREVISION 2026.4
CONFIGURATIONCVSS 7.5 (HIGH)

Security Headers Scanner

Check if your site has the right HTTP security headers configured to prevent common browser-level attacks.

Technical Scope & Verification Behavior

Verifies Content-Security-Policy (CSP), Strict-Transport-Security (HSTS), X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy.

Automated Inspection Checks (12)
Passive URL parameter fuzzing
Non-destructive boundary tests
Header & cookie flag assertions
Differential latency timing

Proof of Concept (PoC) Vector

Canonical test payload dispatched during security surface audits.

Missing Content-Security-Policy and Strict-Transport-Security

Probe Execution Simulator

Watch the probe engine test this signature in an isolated sandbox.

probe-runner (isolated ephemeral container)
Click 'Simulate Check' to watch the headless audit engine test this vector.

Remediation Patch

Next.js Security Headers Config

patch.diff (typescript)
--- a/handler.typescript (Vulnerable)
// next.config.js without headers
+++ b/handler.typescript (Remediated)
const headers = [
  { key: 'X-Content-Type-Options', value: 'nosniff' },
  { key: 'X-Frame-Options', value: 'DENY' },
  { key: 'Strict-Transport-Security', value: 'max-age=63072000; includeSubDomains; preload' },
];

Enforce modern security headers to eliminate clickjacking, MIME-sniffing, and protocol downgrade attacks.

AI Agent Prompt (Cursor · Claude · Copilot)

Copy and paste into your editor to refactor this issue automatically.

"Add HSTS, CSP, and X-Content-Type-Options to the headers configuration in next.config.ts or your reverse proxy."

Run Isolated Check

Test your public domain specifically for Security Headers Scanner.

100% passive • No server load

Specification Details

CVSS Score
7.5 / 10.0
Severity Level
HIGH
Category
CONFIGURATION
Test Vectors
12 automated
Execution SLA
< 2.5 seconds
False Positive Defense
Strict assertion
Related Standards
#CSP#HSTS#Headers#Defense-in-Depth

Run continuous monitoring for Security Headers Scanner

Audit your site across all 41 vectors automatically on every deploy.

Back to Catalog