Server Configuration

HTTP Headers

Headers are the hidden "instructions" your server sends to the browser. They tell Chrome or Safari how to behave, what to block, and what to allow.

Analyze My Headers

Detect missing security policies & leaks

01 The Hidden Conversation

Every time you visit a website, there is a silent conversation between your browser and the server. The server sends "Headers" before sending the actual website content. These headers control caching, security rules, and data privacy.

02 The "Envelope" Analogy

Think of your website content as a letter. The HTTP Headers are the instructions written on the outside of the envelope:

Security Headers
"Confidential. Do not photocopy. Do not let strangers read this." (Prevents XSS, Clickjacking)

Information Leaks
"Sent from Printing Press Model X100." (Tells hackers exactly what machinery you use)

03 The Checklist

We check for two things: Missing Protections and Dangerous Leaks.

Must Have

Protective Headers

  • Strict-Transport-Security (Force HTTPS)
  • X-Content-Type-Options (Stop MIME sniffing)
  • X-Frame-Options (Stop Clickjacking)
Remove

Leaky Headers

  • Server (e.g., Apache/2.4.41)
  • X-Powered-By (e.g., PHP/7.4)
  • X-AspNet-Version (e.g., 4.0.30319)

04 Reducing the Attack Surface

By removing detailed version numbers from your headers, you make it harder for automated bots to target you. If a bot knows you are running an outdated version of PHP, it will launch a specific attack for that version.

Security through Obscurity? While hiding headers isn't a full defense, it stops "Script Kiddies" and automated scanners from identifying you as an easy target.

05 Frequently Asked Questions

What is the 'Server' header?

It reveals what software your server is running (e.g., 'nginx/1.18.0'). Hackers use this to find known vulnerabilities for that specific version.

Do I need all security headers?

Ideally, yes. Headers like HSTS, X-Frame-Options, and Content-Security-Policy provide different layers of protection. Missing one leaves a specific door open.

Can headers break my website?

Yes, especially Content-Security-Policy (CSP). If you block all external scripts, your analytics or embedded videos might stop working.

How do I add these headers?

You add them in your server configuration file (like .htaccess for Apache, nginx.conf for Nginx, or vercel.json for Vercel).

Lock Down Your Metadata

Stop leaking server details and enforce strict browser security.

Scan HTTP Headers