Which security headers extension to use, and what it misses

A security headers extension is a browser add-on that looks at the HTTP response headers of the page you are viewing. It flags which recommended security headers are set and which are missing. It is a spot check, not a scanner: it looks at one page at a time, from your browser.

These extensions come in two designs. Some pass the job to an outside grading service. With the securityheaders.io extension, you click the icon to get the score of the page you are looking at ^[4]. Others do all the work in the browser. HTTP Security Header Checker says it works entirely locally and only reads headers from the current tab when you click the extension ^[1].

The design affects what you can trust the result for. A remote service grades whatever it gets back when it requests the URL, and that may not match the response your browser received. Neither design crawls a site, and you should not assume either one covers pages behind a login. A clean result applies only to the page you checked.

Three extensions come up when you search for a security headers checker, and they differ more than their names suggest. One returns a score from an outside service, one validates a fixed list of headers locally, and one checks whether security headers are present at all. Choose based on how it checks and how current it is. Popularity tells you little.

Before you install any of these, open the Chrome Web Store listing and look at the Updated date and version. Recommended headers change over time. A checker that has not been updated in years may pass a site that current guidance would flag. An old listing is a reason for caution, though it does not prove the tool is broken. Install counts don't help much either: a small user base says nothing about whether the checks are right.

ReCX Security Analyser also shows up in searches for this term. Its current listing could not be verified for this comparison, so it is not covered here.

If you want to check more than the single page in your tab, a free surface scan needs no credit card to start.

Every one of these extensions is checking for response headers that tell the browser to enforce protections. Two of the most important are Content-Security-Policy and Strict-Transport-Security. CSP prevents a wide range of attacks, including cross-site scripting and other cross-site injections ^[6]. HSTS helps protect websites against protocol downgrade attacks and cookie hijacking ^[6].

OWASP runs a Secure Headers Project to raise awareness and use of these headers ^[7]. Its reasoning is simple: once set, these HTTP response headers can stop modern browsers from running into easily preventable vulnerabilities ^[7]. For a plain-language walkthrough of each header on a typical checker's list, see what security headers mean and why they matter.

The securityheaders.io extension is not a separate grading engine. Clicking its icon returns the securityheaders.io service's score for the page ^[4], so the extension and the website give you the same verdict. People who search for "security headers io" or "security headers by snyk" end up at the same tool.

The service has changed hands. Scott Helme built the extension ^[4]. securityheaders.com was acquired by Probely in June 2023, and Probely later came under Snyk ^[3]. The free website still gives the same kind of one-page grade. If a script or CI job depends on its API, check the current terms with Snyk directly. Blog posts about the service's future are not a reliable basis.

For what this type of grade covers and what it leaves out, read what a security headers check tells you and what it misses.

Browser extensions can change security headers before the page is enforced. Researchers analyzed 186,434 Chrome extensions on the official Chrome Web Store and found 2,485 of them intercepting and modifying at least one security header ^[2]. That is about 1.3 percent of the extensions studied.

This affects you in two ways. First, an ad blocker, privacy tool or developer add-on that rewrites headers can leave your header checker looking at a different response from the one the server sent. To rule that out, run the check in a fresh browser profile or a private window with other extensions turned off. Second, some of your visitors may run extensions like these, which means they may not get the protection your headers are meant to give, whatever your grade says. The extensions could be acting for many reasons. The practical result for your visitors is the same either way.

A strong header grade means the browser has been told to enforce some protections. It does not show whether one user can open another user's records, whether a checkout can be tricked into a lower price, or whether a form field echoes a script back onto the page. Those bugs live in the app's code, and a header check never touches them.

To fix what an extension flags, follow how to set up security headers in a web application. If your backend serves JSON instead of pages, see checking security headers on an API. Browser extensions only read pages you load in a tab.

To look past headers, a full scan crawls your application as each user role: anonymous, logged-in and admin. It tests for broken access control, business logic flaws such as price manipulation and workflow bypasses, and reflected, stored and DOM-based cross-site scripting. It is not a comprehensive security audit, and it does not replace an assessment by qualified security professionals.