Lion Cipher Lab
Read a website's HTTP security headers
- AppSec / DevSecOps
- Beginner
- ~30 min
- Free · no account required
Why it matters
When a browser loads a page, the server can send a set of response headers that instruct the browser to enforce specific protections — force HTTPS, refuse to run injected scripts, refuse to be framed by another site, stop guessing file types. These are cheap, powerful, and entirely under the site owner's control, and yet they are frequently missing or misconfigured. Learning to read them tells you, in seconds and without touching anything, how seriously a site takes browser-side defence — and if you build web apps, it shows you the exact levers you should be setting. Reading headers is not an…
What you'll learn
- reading response headers with curl -I
- recognising HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy
- knowing what each header defends against
- spotting a missing header
- reasoning about defence-in-depth on the web
Steps in this lab
- Read the headers: one benign request, then look
- Strict-Transport-Security (HSTS): force HTTPS
- Content-Security-Policy (CSP): refuse injected scripts
- X-Content-Type-Options: stop MIME sniffing
- X-Frame-Options (and frame-ancestors): stop clickjacking
- Referrer-Policy, and reading the whole set as a checklist
- Why a HEAD request tells you so much