score // your website's headers

one curl command, a whole lot of missing homework

you spend money on a nice server, a nice cert, maybe a waf. then you never check whether your site is actually telling browsers how to protect the people visiting it. security headers are basically instructions your server hands to every browser that shows up, and if those instructions are missing, the browser just defaults to "eh, do whatever." here's the one liner that shows you what your site is actually saying.

curl -sI https://yoursite.com | grep -iE 'strict|content-sec|frame'

run that against your own domain right now. if it comes back empty, that's not a good sign, that's just silence.

breaking down the command

curl -sI grabs just the response headers from your site without downloading the whole page. the -s keeps curl quiet about progress stuff, and -I tells it "just give me the headers." then that output gets piped into grep -iE, which searches case-insensitively for a few patterns at once, separated by the pipe symbol inside the quotes. so it's filtering for anything with "strict," "content-sec," or "frame" in it, which lines up with three of the most important security headers you can set.

what strict is checking for

this is looking for strict-transport-security, known as hsts. this header tells the browser "never talk to me over plain http again, only https, for the next however-many seconds." without it, if someone types your domain without the https part, or clicks an old http link, there's a window where a network attacker could intercept that first request before the redirect to https happens. hsts closes that window. if you don't see it in your output, add it in your web server config, something like:

Strict-Transport-Security: max-age=31536000; includeSubDomains

what content-sec is checking for

this one's hunting for content-security-policy, or csp. think of csp as a bouncer for your webpage that decides what scripts, styles, images, and frames are allowed to load and from where. without it, if an attacker manages to sneak a bit of javascript into a comment field or a form on your site, the browser will just run it, no questions asked. that's the classic xss scenario. a csp header locks that down by only allowing scripts from sources you explicitly trust, so injected code from somewhere random just gets refused. a basic starting point looks like:

Content-Security-Policy: default-src 'self'

you'll likely need to loosen it slightly depending on what cdns, fonts, or analytics you use, but starting locked down and opening up is way safer than the reverse.

what frame is checking for

this catches x-frame-options, which stops your site from being loaded inside an iframe on someone else's page. sounds minor until you think about clickjacking, where an attacker overlays your login button or a payment button inside an invisible iframe on their own malicious page, and tricks a user into clicking what they think is one thing but is actually your site underneath. setting this to deny or sameorigin shuts that down completely.

X-Frame-Options: SAMEORIGIN

going beyond the one liner

this command is a fast gut check, not a full audit. once you've patched what it finds, run your domain through a proper header scanner like securityheaders.com or mozilla observatory to get a full grade and catch things this grep won't, like x-content-type-options or referrer-policy. those tools will also flag misconfigurations, not just missing headers, which matters because a badly written csp can be just as useless as no csp at all.

the takeaway

security headers are one of those things that take five minutes to add and quietly close off entire categories of attacks, but almost nobody checks for them until something goes wrong. run the curl command on every domain you own, not just your main site, because subdomains and staging environments get forgotten constantly. fix what's missing, rerun the command to confirm it stuck, then go check the ones you manage for clients or your team too. it's a small habit that pays off way more than its five minutes of effort deserve.