Your Security Headers Are Probably Failing. Here's How to Check (Free).
Why your security baseline stops enterprise deals—and how to fix it.
Imagine this: A SaaS founder wakes up to panicked Slack messages. Overnight, someone injected a malicious script into their customer dashboard. The script quietly harvested session tokens from every user who logged in. By morning, attackers had accessed dozens of customer accounts — and the breach notifications were just beginning.
The attack vector? A stored XSS vulnerability that could have been neutralized by a properly configured Content Security Policy — a security header that takes minutes to implement but wasn't on anyone's radar.
This scenario plays out more often than most founders realize. The fix is straightforward. The consequences of skipping it are not.
The Veto Point: Why Your Security Baseline Stops Enterprise Deals
If you're building something with real stakes — SaaS, fintech, anything touching enterprise customers — security is part of the product now. And the fastest way to fail a security review is also the easiest thing to fix: unconfigured HTTP Security Headers.
Headers like HSTS, CSP, and X-Frame-Options tell the browser how to behave — blocking common attacks like XSS and clickjacking before they can execute. If you don't have them configured, that's a red flag in any serious security review.
⚠️ According to security research, over 50% of websites lack basic security headers. Most frameworks and hosting platforms don't configure these by default.
What You're Actually Exposed To
Security headers aren't abstract compliance checkboxes — they're direct defenses against specific, well-documented attacks. Here's what each one protects against:
Content-Security-Policy → Cross-Site Scripting (XSS) Without CSP, an attacker who finds any way to inject a script into your page — via a form field, URL parameter, or compromised third-party library — can execute arbitrary JavaScript in your users' browsers. That means stealing session cookies, redirecting to phishing pages, or silently exfiltrating data. CSP tells the browser exactly which scripts are allowed to run, neutralizing injected payloads.
X-Frame-Options → Clickjacking
Clickjacking embeds your site invisibly inside a malicious page, tricking users into clicking buttons they can't see — like "Transfer Funds" or "Delete Account." Without this header, attackers can frame your application and hijack user interactions. X-Frame-Options (and CSP's frame-ancestors) prevent your site from being embedded where it shouldn't be.
Strict-Transport-Security → Protocol Downgrade & Man-in-the-Middle Even if you have SSL, users who type your URL without "https://" can be intercepted before the redirect happens. HSTS tells browsers to always use HTTPS — no exceptions, no redirect window. This closes the gap where attackers on public WiFi can intercept that first HTTP request and inject their own content or steal credentials.
X-Content-Type-Options → MIME Sniffing Attacks Browsers try to be helpful by guessing file types — but that "helpfulness" lets attackers disguise executable scripts as harmless files. Upload a .txt file that's actually JavaScript, and some browsers will execute it. This header forces browsers to respect declared content types, blocking a common attack vector for sites with file upload functionality.
Referrer-Policy → Sensitive URL Leakage When users click links on your site, the browser sends the full URL — including query parameters — to the destination. If your URLs contain session tokens, user IDs, or internal paths, that's sensitive data leaking to third parties. Referrer-Policy controls exactly what information gets shared when users navigate away from your site.
Permissions-Policy → Unwanted Feature Access Modern browsers expose powerful APIs — camera, microphone, geolocation, payment handlers. Without Permissions-Policy, any script running on your page (including compromised third-party tags) could request access to these features. This header lets you explicitly disable capabilities your application doesn't need, reducing your attack surface.
The scan below checks for all of these. In about five seconds, you'll know exactly which of these attack vectors apply to your site.
"But I'm on Squarespace / Wix / Webflow..."
Here's something easy to miss: your hosting platform doesn't automatically protect you. Squarespace, Wix, Webflow, WordPress.com — they provide hosting and SSL, but they typically don't configure security headers for you. Your site can still be missing HSTS, CSP, and other critical protections.
The good news? These platforms can be secured. By routing traffic through a service like Cloudflare, you can add the security layer these platforms don't provide out of the box — without changing your hosting. FEDLIN's Web & API Security service handles exactly this configuration — tuning headers, CSP policies, and DNS trust chains against your actual stack.
For Developers Running Custom Stacks
If you're shipping Next.js, Astro, React, or managing your own infrastructure — you already know security headers exist. You've probably configured a few. The question is whether your configuration is complete, correct, and not breaking anything.
The scan below uses the same scoring methodology as Mozilla Observatory. It's a quick gut-check, not a replacement for a proper security review — but it'll tell you if there are obvious gaps.
Building for clients? If you'd rather focus on building and leave security to someone else, I get it — that's exactly how I feel about front-end design. Let's talk if a partnership makes sense.
The CSP Problem: Why This Gets Complicated
Basic headers like HSTS are straightforward. But achieving a solid, non-breaking configuration — especially for Content Security Policy (CSP) — is where things get tricky.
A misconfigured CSP can cause:
- Functionality Complications: Broken front-end assets, image loading failures, or non-functional analytics scripts, forcing a rollback.
- Unnecessary Configurations: Using overly broad or generic policies that defeat the security purpose but pass a basic scan, leaving you exposed.
Done right, a security headers configuration is minimal, effective, and tested against the client's production environment before deployment—not a copy-paste job that breaks functionality.
WAFs and Headers: A Critical Distinction
⚠️ Do not make the mistake of assuming your existing protections cover this gap.
Your WAF is your perimeter defense — it blocks attacks before they reach your app. But security headers work inside the perimeter, at the browser level.
Think of it this way: if an XSS payload somehow gets past your WAF, CSP is your last line of defense — it tells the browser "don't execute code that doesn't come from these trusted sources." They're complementary layers. You need both.
A Free Security Headers Scan
I built this tool because it's the first thing I check on every engagement. It's a Cloudflare Worker that fetches your URL and scores the response headers—the same check we run for clients. You can run it below; no signup required.
Scoring modeled after Mozilla Observatory and securityheaders.com—same headers enterprise reviewers look for.
Same edge platform we use for client work—including CSP and other header hardening. You get to try the stack before anything else.
Try it on your site below.
Check Your Security Headers
See what enterprise security teams see when they evaluate your site. Enter your URL below.
Email these results to yourself
FEDLIN receives a copy and may follow up.
Check your inbox.
Unable to scan
-
scan_security_headers at https://mcp.fedlin.com/mcp From F-Grade to a Clear Fix
If your scan comes back below an 'A', you've got a defined problem with a clear fix. Header hardening is one of the fastest security wins—no app rewrite, just configuration at the edge.
We do this for clients as part of our Edge Security work: same kind of scan, then WAF, headers, and (when needed) CSP at the edge. If you want to go deeper, the links below point to our service page and contact.
Subscribe to Security Insights
Get enterprise security tips, compliance guides, and best practices delivered to your inbox.
Not sure where your security posture stands?
Start with a scoping call. We map your exposure across web, email, credential, AI, and breach history, and sequence the work into a prioritized plan with a Year 1 roadmap — built around what your architecture requires.