this post was submitted on 18 Mar 2026
-4 points (16.7% liked)

netsec - Network Security

447 readers
19 users here now

This is the netsec Community, a community-curated aggregator of technical information security content. Our mission is to extract signal from the noise - to provide value to security practitioners, students, researchers, and hackers everywhere.

Content Guidelines:

Discussion Guidelines:

Prohibited Content:

founded 2 years ago
MODERATORS
 

I've been running security header checks on the top 1000 websites and the results are concerning. Built a tool to make this easy for anyone:

https://devtoolkit.dev/headers

It checks for:

  • Content-Security-Policy (and whether it's actually restrictive)
  • Strict-Transport-Security (including preload)
  • X-Content-Type-Options
  • X-Frame-Options
  • Referrer-Policy
  • Permissions-Policy
  • X-XSS-Protection (deprecated but still checked)

Gives a 0-100 score with specific recommendations for each missing/weak header.

Interesting findings:

  • ~40% of sites I tested are missing CSP entirely
  • Many sites set HSTS but with short max-age (< 1 year)
  • X-Frame-Options is still commonly used but CSP frame-ancestors is better
  • Permissions-Policy adoption is shockingly low

No signup, no tracking, no data collection. Just paste a URL and get results.

Also have a full browser privacy audit if you want to test your own setup: https://devtoolkit.dev/privacy-audit

Feedback welcome — especially on what other checks would be useful.

top 1 comments
sorted by: hot top controversial new old
[–] JRaccoon@discuss.tchncs.de 1 points 18 hours ago

Domain not DNS resolving