Performing Security Headers Audit

When to Use

• During authorized web application security assessments as a standard configuration review
• When evaluating browser-level protections against XSS, clickjacking, and data leakage
• For compliance assessments requiring security header implementation (PCI DSS, SOC 2)
• When performing initial reconnaissance to identify easy-win security improvements
• During CI/CD pipeline security gate checks for new deployments

Prerequisites

• Authorization: Written scope for the target application (header review is low-risk)
• curl: For fetching response headers from target endpoints
• SecurityHeaders.com: Online scanner for quick header assessment
• Mozilla Observatory: Mozilla's web security testing tool
• Burp Suite: For comprehensive header analysis across multiple pages
• Browser DevTools: For examining headers and CSP violations in real-time