BAOI · ANALYSE-SECURITE
HTTP & web security analysis
Understand HTTP security headers
HSTS encourages HTTPS, Content-Security-Policy restricts content sources and X-Content-Type-Options: nosniff reduces MIME confusion.
Recommended checks
- Inspect the final HTTPS endpoint and redirect chain.
- Review CSP, HSTS, Referrer-Policy and framing restrictions.
- Test stricter policies on staging before enforcing them.
FAQ
Do headers alone make a website secure? No. Authentication, updates, validation and TLS still matter.
Can a strict CSP break features? Yes. Review violation reports and legitimate dependencies first.
Practical example: read an HTTP analysis
Test a specific public URL
Enter the HTTPS URL of a public page, such as https://example.com, and run the analysis. The JSON report records the information returned by the service for that URL. Use the same path and note the test time when comparing results.
Interpret the response in context
Read status codes and headers alongside the URL, redirects and purpose of the page. A 401 or 403 response can indicate an access restriction; a redirect can lead to another page. Security headers are a configuration check, rather than proof of an application’s overall security.
Validate an HTTP change
- Compare reports before and after the change on the pages actually affected.
- Test useful browser functions, including forms, authentication and loaded resources.
- For CSP or HSTS, prepare the change and rollback, then verify the effects on the services concerned.
Technical references: RFC 9110 — HTTP Semantics