Security Headers & Endpoints
How RiskShelter crawls your web endpoints and grades their defensive header configuration.
HTTP response headers tell browsers how to handle your content: what scripts are allowed to run, whether connections must be encrypted, and whether your pages can be framed. Getting them wrong leaves your users exposed to script injection, clickjacking, and downgrade attacks.
The Endpoints tab
Every crawled URL appears with its status code, detected server software, and a header grade. Click any row to open the Security Headers drawer: a full header-by-header breakdown with your current configuration, what's missing, and copy-paste remediation snippets for NGINX, Apache, and Cloudflare.
What gets checked
Content Security Policy (CSP) controls which sources scripts, styles, and media can be loaded from. Without it, any injected script runs freely. Recommended: default-src 'self'; script-src 'self'; object-src 'none'.
Strict-Transport-Security (HSTS) forces browsers to connect over HTTPS only, preventing SSL-stripping attacks. Recommended: max-age=31536000; includeSubDomains; preload.
X-Frame-Options (or frame-ancestors in CSP) prevents your pages from being embedded in an iframe on a third-party site, blocking clickjacking attacks.
X-Content-Type-Options: nosniff stops browsers from guessing the content type of responses: without this, an uploaded image could be executed as a script.
Referrer-Policy limits how much of your URL gets sent to third-party sites in the HTTP Referer header. strict-origin-when-cross-origin is a safe default.
Permissions-Policy restricts browser APIs (camera, microphone, geolocation) that third-party scripts could otherwise request. Locking these down reduces your exposure if a third-party dependency is compromised.