HTTP Headers Analyzer

How to use it

1. Run curl against your site, from a terminal. -I asks only for the headers, -L follows redirects, and -s hides the progress bar.
2. Paste the result. curl -v output works too.
3. Read what it found, worst first, and copy the nginx lines for anything you want to fix.

Why do I have to paste it?

Your browser won’t let a web page read another site’s headers, and this site has no server of its own to fetch them for you. There’s a benefit, though: you can check an internal site, or a staging server that’s not on the internet, and nothing you paste leaves your browser. It isn’t stored or put in the page address, because headers can contain session cookies.

What it checks

It reads text, so it doesn’t test your site: it can’t tell whether a CSP suits your pages, or try an attack. A clean result means these headers look right, not that the site is secure.

Testing CORS

A server usually only sends CORS headers when the request has an Origin, so plain curl -I may show nothing. Pretend to be the other site:

curl -sI -H 'Origin: https://app.example.com' https://api.example.com/items

For the preflight that browsers send before a PUT or a request with a custom header:

curl -si -X OPTIONS https://api.example.com/items \
  -H 'Origin: https://app.example.com' \
  -H 'Access-Control-Request-Method: PUT'

Adding the headers in nginx

The Nginx Config Generator can add the security headers for you. Otherwise, put the suggested lines inside your server block. Two rules catch people out:

• Keep always, or the header is left off error pages.
• add_header in a location cancels every add_header from the server block. If a location has one of its own, repeat the others there.

sudo nginx -t && sudo systemctl reload nginx
curl -sI https://example.com/ | grep -i strict-transport

FAQ

Should I turn on HSTS right away?

Not before HTTPS works on every address you use. Browsers remember it for as long as max-age says, so if the certificate breaks, visitors can’t click past the warning. Start with a short value, such as max-age=300, then raise it. Add includeSubDomains only if all subdomains have HTTPS.

A strict CSP broke my site

That’s common, as it blocks inline scripts and anything from other domains. Send Content-Security-Policy-Report-Only first. Nothing gets blocked, and the browser’s console lists what would have been. Fix those, then switch to the real header.

Why did it warn about the Server header?

A version number tells attackers which known holes to try. Hiding it isn’t protection on its own, so keep updating. In nginx, server_tokens off; removes the number.

My browser says “blocked by CORS policy”. What now?

Check the real response here, using the Origin command above. The usual reasons are a missing header, * together with credentials, or the header appearing twice because both your app and your proxy add it. For the fixes, see Blocked by CORS policy.

Can it find a redirect loop?

Not by itself, but the list of responses can show one starting. If the browser says “too many redirects”, see ERR_TOO_MANY_REDIRECTS.