Security Headers II Audit

security-headers-ii · v1.0.0 · paid

Advanced security header configuration quality — evaluates whether headers are configured correctly, not just present. Sequel to Security Headers & Basics.

CSP Policy Quality

csp-quality · weight 0.3

CSP uses nonce or hash-based script allowlisting
ab-002418
critical
strict-dynamic in script-src
ab-002415
high
No unsafe-eval in any CSP directive
ab-002425
critical
Restrictive default-src
ab-002423
high
object-src set to none
ab-002426
low
base-uri restricted
ab-002424
medium
style-src does not use unsafe-inline without nonces
ab-002433
low
CSP reporting endpoint configured
ab-002434
low

Cross-Origin Isolation

cross-origin-isolation · weight 0.2

Cross-Origin-Opener-Policy header is set
ab-002436
medium
Cross-Origin-Embedder-Policy configured
ab-002437
medium
Cross-Origin-Resource-Policy on static assets
ab-002432
medium
External links use noopener noreferrer
ab-002435
low
Iframes use sandbox attribute
ab-002444
low

Permissions-Policy Configuration

permissions-depth · weight 0.15

Sensitive APIs restricted (camera, microphone, geolocation)
ab-002445
high
Additional browser APIs restricted
ab-002446
medium
Legacy Feature-Policy header also set
ab-002443
low
upgrade-insecure-requests directive present
ab-002447
medium

Subresource & Third-Party Security

supply-chain · weight 0.2

SRI uses SHA-384 or stronger
ab-002429
medium
SRI elements have crossorigin attribute
ab-002430
high
Third-party scripts use async or defer
ab-002431
medium
No dynamic script injection with user-controlled content
ab-002428
critical
Third-party scripts documented
ab-002427
info

Transport & Response Hardening

transport-hardening · weight 0.15

HSTS includes includeSubDomains
ab-002441
high
HSTS preload flag configured
ab-002438
medium
No mixed content (HTTP resources on HTTPS pages)
ab-002440
critical
Clear-Site-Data header on logout
ab-002439
high