HTTP Headers Forensics

Scenario

You are doing a defensive review of https://app.acme.example/. The customer's CTO wants to know which security headers are missing per the OWASP ASVS v4 §14.4 baseline.

The actual HTTP response headers from the production app are in the right pane.

Objective

List the security headers that are completely absent from the response (not just misconfigured — totally missing).

Headers you must check for (full ASVS baseline):

| Header | Purpose | |---|---| | Strict-Transport-Security | Forces HTTPS, prevents downgrade attacks | | Content-Security-Policy | Mitigates XSS, clickjacking via injection | | X-Content-Type-Options | Stops MIME sniffing | | X-Frame-Options | Anti-clickjacking (older sibling of frame-ancestors) | | Referrer-Policy | Controls Referer leakage | | Permissions-Policy | Restricts browser feature access (camera/mic/geo) |

Answer format

Comma-separated, all lowercase, sorted alphabetically, no spaces:

content-security-policy,permissions-policy,referrer-policy,strict-transport-security,x-content-type-options

(That example shows 5 missing headers — the actual count may be different.)

Tips

• A header that is present but with a weak/empty value is not counted here — we only want totally absent ones.
• X-XSS-Protection is deprecated by modern browsers — do not include it even if missing.
• Match header names exactly (case-insensitive — we'll lowercase your input before comparing).