Security Headers Bulk QA

Bulk-check public pages for scanner-visible HTTP response header signals.

This Actor is for teams that publish many public pages and need a quick evidence report before a launch, migration, CMS template change, or release review. It reads public URLs, follows the normal fetch path, and reports what the scanner can observe in the final HTTP response headers.

What it checks

• Input from urls, sitemapUrl, or public csvUrl
• Fetch status for every sampled URL
• Final URL scheme and HTTP-to-HTTPS redirect behavior
• Strict-Transport-Security presence and parseable max-age
• Content-Security-Policy presence and selected high-risk policy signals
• X-Content-Type-Options: nosniff
• X-Frame-Options or CSP frame-ancestors
• Referrer-Policy
• Permissions-Policy
• Cross-Origin-Opener-Policy
• Cross-Origin-Embedder-Policy
• Cross-Origin-Resource-Policy
• Legacy or information-revealing headers such as X-XSS-Protection, X-Powered-By, and Server
• Bulk patterns where common headers are absent on most sampled pages

Findings

Each finding includes:

• severity
• confidence
• evidence
• caveat
• source URL with query strings redacted
• source references where applicable

Primary finding families include:

• transport.*
• hsts.*
• csp.*
• x_content_type_options.*
• x_frame_options.*
• framing.*
• referrer_policy.*
• permissions_policy.*
• coop.*
• coep.*
• corp.*
• legacy.*
• leakage.*
• bulk.*

Boundaries

This is an informational diagnostic tool for public HTTP responses. It is not a vulnerability scan, penetration test, compliance assessment, managed security service, CSP design service, incident-prevention service, or guarantee that a site is safe, secure, or protected from incidents.

The scanner does not log in, does not bypass robots.txt, does not test private networks, does not exploit behavior, does not render JavaScript, and does not validate whether a policy is correct for a specific application. CSP findings are limited to static header shape and selected visible signals.

Billing note

Pay-per-event billing is based on reachable URLs only. Unreachable pages are reported as findings, but they are not counted as checked URLs.

References

• OWASP HTTP Headers Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html
• MDN Strict-Transport-Security: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Strict-Transport-Security
• MDN Content-Security-Policy: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy
• MDN X-Content-Type-Options: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Content-Type-Options
• MDN X-Frame-Options: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options
• MDN Referrer-Policy: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Referrer-Policy
• MDN Permissions-Policy: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy
• MDN Cross-Origin-Opener-Policy: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Opener-Policy
• MDN Cross-Origin-Embedder-Policy: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Embedder-Policy
• MDN Cross-Origin-Resource-Policy: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Resource-Policy

Related tools

• Checksmith CI - Use before deploy when the relevant public files are still in the repository.
• Site Migration Redirect QA - Use when launch checks also need redirect-chain and final URL review.
• Policy Page Drift Pack - Use when policy pages should be watched after headers are checked.