A small Node.js CLI that scans HSTS, Content-Security-Policy, X-Frame-Options, Referrer-Policy and more, then tells you exactly what's missing and how to fix it. Built by TrustYourWebsite as part of our compliance scanning suite.
npx @trustyourwebsite/security-headers https://example.comRequires Node.js 18+. Want the full picture — cookies, DNS auth, accessibility, GDPR cookie consent and more — across your entire site? Run a free scan at trustyourwebsite.com.
Security Headers Report
=======================
URL: https://example.com
Grade: B (72/100)
TLS: TLS 1.3
Headers:
✓ Strict-Transport-Security max-age=31536000; includeSubDomains
✗ Content-Security-Policy MISSING — Add CSP to prevent XSS attacks
✓ X-Content-Type-Options nosniff
✓ X-Frame-Options DENY
⚠ Referrer-Policy no-referrer-when-downgrade — Consider strict-origin-when-cross-origin
✗ Permissions-Policy MISSING — Restrict access to browser features
✓ X-XSS-Protection 0 (correctly disabled)
✗ Cross-Origin-Opener-Policy MISSING
Information Disclosure:
⚠ Server: nginx/1.24.0 — Remove version number
⚠ X-Powered-By: Express — Remove this header
Recommendations:
1. Add Content-Security-Policy header (HIGH priority)
2. Add Permissions-Policy header (MEDIUM priority)
3. Remove server version from Server header (LOW priority)
Full website compliance scan → https://trustyourwebsite.comOnly Node's built-in node:https, node:http and node:tls. Security tooling should have minimal attack surface.
Exit-code aware --ci mode with a configurable --min-grade. Drop it into GitHub Actions or GitLab CI in one line.
Doesn't just check if CSP exists. Parses every directive, flags unsafe-inline, unsafe-eval, wildcards and other footguns with specific fix advice.
| Header | Weight | What we check |
|---|---|---|
Strict-Transport-Security | High | max-age ≥ 1 year, includeSubDomains, preload |
Content-Security-Policy | High | Dangerous values, directives, wildcards |
X-Content-Type-Options | Medium | Must be nosniff |
X-Frame-Options | Medium | DENY or SAMEORIGIN |
Referrer-Policy | Medium | Privacy-respecting values |
Permissions-Policy | Medium | Dangerous features restricted |
Cross-Origin-Opener-Policy | Medium | same-origin preferred |
Cross-Origin-Resource-Policy | Low | same-origin or same-site |
Cross-Origin-Embedder-Policy | Low | require-corp for isolation |
Cache-Control | Low | no-store or private for sensitive pages |
X-XSS-Protection | Low | Deprecated — should be 0 or absent |
# GitHub Actions
- name: Check security headers
run: npx @trustyourwebsite/security-headers https://your-site.com --ci --min-grade BA real audit also covers cookie consent, GDPR, DNS email auth (SPF / DKIM / DMARC / BIMI / MTA-STS), accessibility, TLS configuration and broken-link health — on every page of your site. TrustYourWebsite runs all of those automatically and gives you a single fix-it report.
Audit SPF, DKIM, DMARC, BIMI and MTA-STS for any domain.
Verify cookie banners actually stop tracking when users click "Reject All".