Bastion
HTTP security header checker
Why the score is weighted rather than a letter
Letter grades invite gaming. A site adds a token header, moves from B to A, and is not one bit safer. The percentage here is weighted by how much each header actually prevents, and the weights are visible in the findings, so you can disagree with the arithmetic rather than being handed a verdict.
A site with a strong Content-Security-Policy and no X-Frame-Options is in
considerably better shape than the reverse, because CSP's frame-ancestors
directive supersedes that header entirely. Scoring them equally would be tidier and
wrong.
The headers that matter most
Content-Security-Policy is the one worth real effort. It is what turns
a stored cross-site-scripting bug from a total compromise into a script that fails to
load. It is also the hardest to deploy, and a policy containing
unsafe-inline in its script sources gives back most of the protection —
which is why a permissive CSP is not scored as a pass here.
Strict-Transport-Security closes the window on a visitor's first
request, before any redirect to HTTPS has had a chance to happen. A max-age under six
months is too short to be much use, and the browser preload list wants a year plus
includeSubDomains.
X-Content-Type-Options: nosniff is one line with no downside. Without it a browser may guess at a response's type and execute an uploaded file as a script.
Version disclosure
A Server or X-Powered-By header carrying a version number is
not a vulnerability. It is, however, the difference between an attacker scanning
everything and an attacker scanning only the things known to be vulnerable to the exact
build you are running.
Removing the version is nearly free and removes you from that filter. Removing the product name entirely gains little more — it is usually obvious from other behaviour.
Headers are one layer, and the thinnest one
Every header here is a browser-enforced mitigation. They constrain what a browser will do with your page; none of them fixes the bug underneath. A perfect score on a site with an SQL injection flaw is a perfect score on a site with an SQL injection flaw.
Treat them as cheap insurance that limits the damage of mistakes you have not found yet — genuinely worth having, and no substitute for input validation, output escaping and keeping software current.
This tool uses the util.quest server. It cannot run in your browser — the work is either impossible there or too heavy for it. What you submit is sent to this server, used to produce the result, and not stored afterwards. Requests are rate limited, and nothing about them is logged beyond what is needed to enforce that.
Read the security headers a site sends — Content-Security-Policy, HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy — and see what each one does and does not protect against. A browser cannot check this for another origin, because the same-origin policy exists to stop exactly that.
It's one of the free tools in the util.quest collection — nothing to install, and no account needed. Found a bug or want a feature? Reach out at [email protected].
