Security Spot-Checks
How do you check a website's security headers?
You check a website's security headers by reading the HTTP response headers of a request, then judging the six that matter: HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy. A one-line curl shows them; a scanner grades them A to F. Bassethound returns that grade inside the five-layer dossier, in a single call.
Best move: read the response headers of one request to the site, then score the six that move the grade.
Why it works: security headers travel in every HTTP response, so a single request exposes what the browser is (and is not) told to enforce. Present but weak counts against the grade.
Key takeaways
- Security headers live in the HTTP response, so one request to the site reveals them. No login, no crawl of every page.
- Six headers carry the grade: HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy.
- Present is not the same as correct. A CSP with unsafe-inline or an HSTS with a zero max-age still leaves holes.
- Header grade and TLS grade are separate axes. A site can ship a valid cert and send zero security headers.
- Bassethound returns the header grade (A to F) next to the tech stack and AI signals in one correlated dossier.
Which headers carry the grade?
Six. HSTS (Strict-Transport-Security) forces HTTPS and closes downgrade attacks. CSP (Content-Security-Policy) constrains what the page can load and execute. X-Content-Type-Options stops MIME sniffing. X-Frame-Options controls framing, which blocks clickjacking. Referrer-Policy limits the URL that leaks in the Referer header. Permissions-Policy gates browser features like camera, microphone, and geolocation.
A grader weights CSP and HSTS heaviest, because those two cut the most risk. The other four are cheap wins that most well-run sites set. Miss all six and you sit at F. Set the two hard ones well, with the rest present, and you approach A. The grade is a weighted read, not a raw count, so a site can hit four of six and still land low if the two it skipped are the load-bearing ones. That weighting is why “we have some headers” tells you less than the letter does.
How do you read the headers yourself?
Three ways. Fastest is one line: curl -sI https://example.com prints the response headers, and you scan for the six names. Browser devtools works too. Open the Network tab, reload, click the document request, and read the Response Headers pane. For a scored view, a public scanner (securityheaders.com, Mozilla Observatory) fetches the site and returns a letter grade with per-header notes.
The curl path is honest about one thing a marketing page hides. It shows exactly what the server sent, with no interpretation. Watch coverage. Headers set on the HTML document can be missing on API routes or asset responses, and the browser only enforces what it receives per response. So checking the homepage alone can overstate the posture. Read a couple of response types before you trust the grade.
Why is “present” not the same as “correct”?
A header can exist and still do nothing. HSTS with max-age=0 disables itself. A CSP with unsafe-inline and unsafe-eval waves through the exact scripts it should block. The browser ignores an X-Frame-Options set to an invalid token.
So a checklist that only asks “is the header there?” overstates the posture. A real check parses the value. It reads the HSTS max-age and looks for includeSubDomains and preload. It flags CSP wildcards, unsafe-inline, and unsafe-eval. It confirms X-Content-Type-Options is the literal string nosniff, not a paraphrase. It checks that Referrer-Policy is a strict value like no-referrer or strict-origin-when-cross-origin rather than the permissive unsafe-url. Grade on the value, not the presence. Two sites can both “have CSP” and land two letter grades apart on the strength of the directive list.
How is the header grade different from the TLS grade?
Two separate axes. The TLS grade covers the certificate and the transport: issuer, expiry, days remaining, protocol versions, and cipher strength. The header grade covers what the server tells the browser to enforce once the connection is up.
A site can hold a valid, modern cert and send zero security headers, so it earns a strong TLS grade and an F on headers. The reverse happens less often, but a site can set every header and let its certificate lapse. The two axes fail independently, which is why one number hides the weaker one. Bassethound reports both, then fuses them into a single security_grade so the weaker axis surfaces at a glance. You do not have to run one tool for the cert and another for the headers and reconcile the two.
Can you check headers across many domains at once?
Yes, and that is where a manual curl stops scaling. Checking one site by hand takes a minute. Checking a list of 500 prospects, or re-checking them weekly for drift, is a job for an API.
That is the shape Bassethound fits. An agent calls sniff_domain once per domain, and the security layer comes back scored alongside the tech stack, infrastructure, firmographics, and AI-readiness signals. One call, five correlated layers. You get the header grade in the same response that tells you the CDN, the email provider, the TLS expiry, and whether the company ships AI. For a security spot-check that has to run across a book of accounts, the value is not the header read on its own (a free scanner does that fine) but the header read arriving already joined to everything else you need to qualify the domain.
Bassethound perspective
A security-header check is a solved, commoditized read. securityheaders.com does it well and does it free. So we do not pitch it as the product. The conviction a dedicated scanner would dispute: a header grade is worth more correlated than alone. Knowing a site scores C on headers is a footnote. Knowing that same C sits on a Vercel front end, a Cloudflare edge, an Anthropic backend, and a shipping AI-readiness verdict is a qualified lead or a triaged risk. An agent that fans out to five separate MCPs (one for headers, one for TLS, one for tech, one for infra, one for firmographics) pays five round trips and still has to stitch the answers itself. Correlation is the work, and it is the part a single-layer scanner never does. We return the header grade because the dossier would be dishonest without it, not because it is the reason to call us. Be clear on the limit too. Headers are read per response, so a header set on the document but missing on an API route is a gap, and the dossier says so.
Sources
- MDN, HTTP headers reference: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers
- MDN, Content-Security-Policy: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
- MDN, Strict-Transport-Security: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
- IETF RFC 6797, HTTP Strict Transport Security: https://datatracker.ietf.org/doc/html/rfc6797
- Mozilla SSL Configuration Generator: https://ssl-config.mozilla.org
Frequently asked questions
Do you need to log in to check a site's security headers?
No. Security headers ride in the HTTP response of a plain request, so an unauthenticated curl or scanner reads them. Some headers only appear on authenticated routes, so a full picture checks a few response types, not just the homepage.
Does a green padlock mean the headers are set?
No. The padlock means the TLS certificate is valid, which is the transport axis. Security headers are a separate axis, and a site with a perfect cert can send none of them.
Which header should you fix first?
HSTS and CSP. HSTS forces HTTPS and closes downgrade attacks. CSP constrains what the page can load and run, which cuts the largest class of injection risk. The other four headers are quick follow-ups.
Can a header be present but useless?
Yes. HSTS with max-age=0 disables itself, and a CSP with unsafe-inline permits the scripts it should block. Grade the value, not the presence.
How does Bassethound score the header grade?
It reads the six headers on the response, parses each value, and returns an A to F grade fused with the TLS grade into one security_grade, inside the same five-layer dossier as the tech and AI signals.