Evaluating Website Security Headers With a Straightforward Scan
When a visitor lands on a website, the exchange between browser and server is almost invisible. A handful of response instructions travel back with the page and tell the browser how to behave, what to block, and how strictly to trust the connection. Many of these instructions sit in HTTP response headers, and a surprising number of them are specifically designed to harden a site against common attacks. The trouble is that they are often absent, misconfigured, or quietly dropped during a CDN migration, leaving a business exposed without anyone noticing.
In Australia, where the Notifiable Data Breaches scheme under the Privacy Act 1988 obliges businesses above the AUD 3 million turnover threshold to report serious incidents, ignoring small misconfigurations can quickly become expensive. A handful of widely publicised breaches on the east coast, from a Sydney-based health insurer to a Melbourne retail platform, have shown that attackers often pivot on weaknesses a careful header review would have caught. The Australian Cyber Security Centre regularly cites misconfigured web servers and missing transport security as recurring themes in its annual threat reports, which makes a header review an obvious starting point for any local security audit.
A security header is essentially a line of text the server sends before any HTML, such as Strict-Transport-Security, Content-Security-Policy, or X-Frame-Options. Each one controls a different behaviour, from whether the browser must use HTTPS to which scripts may execute or whether the page can be embedded in a hostile iframe. Together they form a defensive layer that runs invisibly, but only when configured correctly. When a developer copies a config from a tutorial written in 2018 or leaves a header in staging mode, that layer thins out fast.
A straightforward scan is the most efficient way to surface what is actually live on a given domain. Rather than reading through dozens of raw response lines in a terminal, you can let a tool do the heavy lifting and produce a clear summary of what is present, what is missing, and what looks weak. The rest of this article walks through what those headers do, how to scan for them, and what to do with the results once they are in front of you.
Understanding HTTP security headers and their purpose
Every modern browser speaks HTTP, and every response it receives carries a collection of metadata fields. Most of them relate to caching, content negotiation, or session handling, but a smaller group is dedicated to security. These fields are not encrypted, not hidden, and do not require any special access to inspect. They are the simplest piece of evidence about how seriously a site treats its visitors, because a missing header is often the only outward sign of a hurried deployment.
The reason security headers exist is that the browser is, by default, a fairly trusting environment. If a piece of JavaScript tells the page to redirect to another origin, the browser usually obliges. If a third party injects an iframe pointing at a banking site, the browser loads it. Security headers pull that trust back a notch. They tell the browser which sources are acceptable, which behaviours to refuse, and which connections to upgrade automatically. Without them, attacks such as cross-site scripting, clickjacking, and protocol downgrade become much easier to pull off.
For a small Australian retailer running on a managed platform, the temptation is to assume the platform vendor handles all of this. In practice, headers often live at the web server or CDN level, and they can be overwritten by a theme update, a marketing landing page, or a new plugin. A site that was clean in Brisbane last quarter can drift out of compliance the moment a campaign microsite is bolted on. That is why a periodic scan matters, even on infrastructure that is otherwise well maintained.
A common misconception is that headers are only relevant to financial or government services. Attack tooling today is largely automated, scanning thousands of sites an hour regardless of sector. A blog, a portfolio, or a local service business can be caught up in a broad sweep simply because it left one header missing. Reviewing what your site actually serves is the only way to know which of those automated probes will pass you by and which will get stuck in a waitlist for a future attack.
Key security headers every website should have
Strict-Transport-Security, usually abbreviated to HSTS, is the foundation. It tells the browser to refuse any future connection over plain HTTP, even if the user types it that way or clicks an old bookmark. For a country where mobile users on patchy 4G connections in regional Victoria or Western Australia sometimes fall back to HTTP, HSTS quietly closes that gap. A reasonable starting value is max-age=31536000; includeSubDomains; preload, with the preload directive reserved for sites that are committed long term.
Content-Security-Policy is the most powerful and the most painful to configure. It controls which scripts, styles, images, and frames a page is allowed to load. A tight policy is a serious defence against cross-site scripting, because even if an attacker manages to inject a script tag, the browser will refuse to run it if its source is not whitelisted. Getting it right takes time, which is why many Australian teams start with a report-only policy, watch what the browser would have blocked, and tighten it gradually. Tightening your img-src directive often goes hand in hand with faster page loads, since both rely on a tight allow-list of trusted CDNs.
X-Frame-Options and the modern frame-ancestors directive in CSP exist to prevent clickjacking, where an attacker overlays your interface inside a hostile page. If your site should never be framed, set the header to DENY or to an allow-list of trusted origins. X-Content-Type-Options stops MIME sniffing, telling the browser to treat the declared content type as final. That matters when your site serves user-uploaded media, including audio assets from third-party pipelines, which is why some teams publishing guides on how to extract audio tracks also recommend setting nosniff to block browsers from reinterpreting a file mid-stream.
Referrer-Policy and Permissions-Policy round out the modern set. Referrer-Policy controls how much of the URL is sent when a user clicks an outbound link, which can leak internal paths and IDs. Permissions-Policy lets a site opt out of powerful features such as camera, microphone, geolocation, or payment APIs when the page does not need them. Together with HSTS and CSP, they cover the bulk of the recommendations published by the Australian Signals Directorate and aligned with its Essential Eight mitigation strategies.
Running a header scan without a technical background
You do not need a penetration test to see what your headers look like. The simplest way is to open a browser, visit your site, and inspect the response using the developer tools built into Chrome, Edge, or Firefox. The Network tab records every request, and clicking through to the response headers reveals the full list. For a faster, more visual review, public scanners accept a domain and produce a colour-coded report in seconds. They will usually highlight missing headers in red and out-of-date values in amber.
For a fuller picture, the command line offers a quick route. Tools like curl -I https://yourdomain.com.au on macOS or Linux print the headers directly, and adding -v shows the full negotiation. If you want to check many domains at once, a small script can be written in an afternoon, but for most business owners the web-based approach is enough to start with. The point of the exercise is to see what a real visitor would see, not to chase exotic edge cases.
A useful habit is to scan the marketing subdomains as well. Many Australian businesses run their blog on a separate platform, host landing pages on a campaign tool, or push event microsites through a third-party builder. Each of these is a separate origin and a separate header configuration. High-traffic promotional pages, including the kind used in entertainment campaigns such as an American roulette spin promotion, often sit on a subdirectory or subdomain that gets less attention from the security team than the main storefront, even though it carries the same brand and the same audience.
When you run the scan, capture a screenshot or export the result. Headers change over time, and you will want a baseline to compare against. If your site moves behind a new CDN, switches to a different host, or receives a major redesign, run the scan again. The first time you compare results you may be surprised at how often a header quietly disappears during a routine deployment.
Interpreting scan results and spotting real risks
A scanner will usually produce a list of headers, each tagged as present, missing, or weak. The temptation is to chase a perfect score, but the practical goal is to remove the most common attack paths. Start with anything in red, particularly missing HSTS, missing X-Frame-Options, and an absent or wildcard Content-Security-Policy. Those three are the highest-impact gaps, and addressing them removes a large slice of typical web risk.
A weak value is not always a critical issue. A short HSTS max-age, for instance, is better than nothing at all and gives you room to grow. A CSP that starts in report-only mode is a normal step during rollout. The header you want to scrutinise carefully is one that has been partially set, perhaps with a syntax error the browser silently ignores, because that gives a false sense of safety. Most scanners flag syntax problems explicitly, so read those notes rather than skimming the score alone.
Be careful with third-party scripts. A CSP that whitelists every analytics tag, ad network, and chatbot widget in use is barely a CSP at all. The Australian privacy conversation around consent management has made this harder, because a poorly configured CSP can break consent banners and lead to regulatory complaints. Treat any third-party service as a deliberate addition to your policy, with its own review, and remove entries that no longer match active integrations on your site.
Finally, remember that headers are only one layer. A clean header configuration does not protect against weak passwords, unpatched plugins, or exposed admin panels. Pair your scan with a review of authentication, an audit of exposed endpoints, and a quick check that your hosting provider is still applying the latest TLS configuration. Headers are the cheapest, fastest, and most visible piece of that broader picture, which is why they are worth scanning on a regular cycle.
Hardening headers and verifying improvements
Once you have a list of changes, the next step is to apply them at the right place in your stack. For a static site, the hosting provider or CDN is usually the simplest control point, since headers can be set globally and inherited by every page. For a dynamic application, the framework often has middleware that can add or override headers, which is preferable to editing every route. Australian teams running WordPress, Shopify, or a custom Laravel build will find that most modern platforms have a documented header configuration path that survives theme and plugin updates.
After deploying, run the scan again. The result should show your changes in green, and the baseline screenshot from earlier should now be a useful before-and-after record. A second scan a week later is a good idea, because CDN caches, edge rules, and propagation can occasionally roll a configuration back without warning. Treat the second scan as a smoke test rather than a formality, and you will catch the rare deployment that quietly regresses.
For ongoing maintenance, schedule a quarterly review. Tie it to something memorable, perhaps the start of the Australian financial year or a recurring calendar event in your team, so it does not slip. Each review should look at new headers that have become standard, remove obsolete ones, and revisit the CSP allow-list. Over time, your score should trend upward, and your incident response time should trend downward, because the easy attacks simply fail to land.
A straightforward scan of your security headers is a small task with a large return. It does not require a consultant, a budget, or a long planning cycle. It takes a few minutes, produces a clear list, and turns an invisible part of your site into something you can actively manage. Run one today, store the result, and make the next scan part of your regular routine. The browser on the other end of the connection is already checking, so head over to webyzer.net and put your domain through its paces before the next automated probe does it for you.
