Guides

How to Check HTTP Security Headers with curl

By Ravindra Bagale, Cyber Security trainer · LinkedIn · Published: 27 October 2026 · Last updated: 27 October 2026

Run curl -sI https://YOUR_SITE and look for strict-transport-security, x-content-type-options, x-frame-options or content-security-policy, and referrer-policy. Missing headers are easy wins on your Nginx or Apache host.

curl -sI https://YOUR_SITE | tr -d '\r' | grep -iE 'strict-transport|content-security|x-frame|x-content-type|referrer-policy|permissions-policy'

Why check security headers?

Headers are cheap controls. They cut clickjacking, cookie leaks over HTTP upgrades, and some XSS paths. Diego in São Paulo and Kavya in Coimbatore both put header checks in their go-live list.

What should you look for?

• Strict-Transport-Security (HSTS)
• X-Content-Type-Options: nosniff
• X-Frame-Options or a CSP frame-ancestors rule
• Referrer-Policy
• Content-Security-Policy (plan carefully)

How do I check and fix?

1. Read live headers:

   curl -sI https://YOUR_SITE

   HTTP/2 200
   server: nginx
   content-type: text/html; charset=utf-8

   What it means: This sample response has no HSTS or XCTO yet — gaps to fix.

2. Filter the important ones:

   curl -sI https://YOUR_SITE | tr -d '\r' | grep -iE 'strict-transport|content-security|x-frame|x-content-type|referrer-policy' || echo 'NONE FOUND'

   What it means: If you see NONE FOUND, add headers next.

3. Add a starter set in Nginx (your site):

   add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
   add_header X-Content-Type-Options "nosniff" always;
   add_header Referrer-Policy "strict-origin-when-cross-origin" always;
   add_header X-Frame-Options "SAMEORIGIN" always;

   What it means: Starter headers. Tune CSP separately so you do not break scripts.

4. Test and reload: sudo nginx -t && sudo systemctl reload nginx.
5. Re-run curl and tick items on the checklist.