· ReadyStack
Worked example
Real numbers from this tool, line by line.
Four header lines, four errors - for web and platform engineers who keep security headers in the repo and have to show a working policy at a PCI DSS assessment.
_headers
3 ERROR Dead header. Chrome removed the XSS Auditor in 2019, Edge followed...
4 ERROR ALLOW-FROM was only ever implemented by IE and old Firefox...
5 ERROR HTTP Public Key Pinning is gone. Chrome removed it in 2019...
6 ERROR CSP keywords are only keywords inside single quotes. Written bare...
6 WARN script-src * or https: permits script from any host on the web...
6 INFO default-src does not cover base-uri, form-action, frame-ancestors...That is a real run over a _headers file copied from a 2019 blog post. Six findings, four of them errors - and none of them would fail a deploy, a curl, or a browser console. A wrong header does not error: it is served, parsed, and the wrong part is quietly dropped.
Line 6 is the one that catches almost everyone.
Content-Security-Policy: default-src selfCSP keywords are only keywords inside single quotes. Written bare, self is parsed as a host name - the browser goes looking for a server literally called self. No console error, no failed request. The same trap applies to none, unsafe-inline and strict-dynamic.
Lines 3, 4 and 5 are a different layer: headers that are simply dead. X-XSS-Protection has done nothing since Chrome removed the XSS Auditor in 2019. Public-Key-Pins was removed in 2019 too, and Expect-CT stopped being enforced in 2022 because Certificate Transparency is now unconditional. X-Frame-Options: ALLOW-FROM was never implemented in Chrome or Safari, so an invalid X-Frame-Options can leave the page framable by anyone.
Then there is the layer the browser throws away on purpose. frame-ancestors, sandbox and report-uri are discarded when a policy arrives in a <meta http-equiv> tag, because those three must apply before the document starts parsing. The rest of the policy still works, so the page looks protected and stays framable.
Two more cost real money. Feature-Policy was renamed to Permissions-Policy, and geolocation 'none' became geolocation=(). Permissions-Policy is a structured field, so the old quoted spelling is a parse error - and a browser that cannot parse a structured header discards the entire header, sending every permission on the line back to its default. And Strict-Transport-Security: max-age=600; preload is refused by the preload list, which requires at least 31536000 seconds plus includeSubDomains: you ship the token for years and were never on the list.
Why does this keep happening? CSP Evaluator and Observatory grade a URL that is already deployed, so every fix costs a deploy cycle and neither sees the config file where the mistake lives. And the fastest source of a header is now an assistant: they still emit X-XSS-Protection, report-uri and bare self, because those were correct when the training data was collected.
So this is a linter, not a scanner. It reads _headers, netlify.toml, vercel.json, nginx or Apache config: 28 rules, one per silent failure, each naming the behaviour you got, not the one you wrote.
If you take card payments this became an audit finding. PCI DSS v4.0.1 requirements 6.4.3 and 11.6.1 have been mandatory since 31 March 2025, and 11.6.1 covers detecting unauthorised changes to HTTP headers on the payment page. The assessor reads the headers you shipped, not the ones you meant.
Run it on the config you have open now - free, in VS Code or the browser, all 28 rules, every finding shown, nothing withheld. For comparison, an AppSec consultant billing $120-275 an hour spends one to two hours per site.
15 seconds — what it actually does
Questions people ask
What does Security Headers Lint actually do?
It reads a config file line by line and names the security header lines that do nothing. It flags retired headers like X-XSS-Protection, Public-Key-Pins and Expect-CT, CSP keywords written without their single quotes, and directives such as frame-ancestors that browsers discard when the policy is delivered in a meta tag. Each finding says what the line does instead of what you meant.
Who is this for?
Web and platform engineers, agencies and ecommerce teams who keep security headers in the repository - a _headers file, netlify.toml, vercel.json, nginx or Apache config, or a meta http-equiv tag. It suits anyone who has to show a working Content-Security-Policy at a PCI DSS assessment, and agencies who need one pass across every client site rather than opening each config by hand.
Why not use CSP Evaluator or ask a chatbot?
CSP Evaluator and Observatory grade a URL that is already live, so each correction costs you a deploy cycle, and neither can see the config file where the mistake is. Chatbots are worse here: they still produce X-XSS-Protection, report-uri and bare self, because those were current when their training data was collected. A wrong header returns HTTP 200 and no console error.
What is free and what needs a licence?
Checking the open file is free and complete: all 28 rules run, every finding is shown, and nothing is hidden, watermarked or time-limited. A licence adds a different job rather than more of the same one - scanning every config in a workspace, exporting a report for an evidence pack, failing CI, adding your own house rules, re-checking on save, and applying the safe fixes.
What would this cost me otherwise?
Application security consultants doing secure code review bill roughly $120 to $275 an hour, and a security-header and CSP review runs one to two hours per site. The licence is $29 once, and the free tier already finishes the job for a single config file.
Why not just ask ChatGPT or another AI chat?
A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. Security Headers Lint - CSP, HSTS and dead headers checks the file you open against 28 rules from a rule set dated 2026-09-20, and points at the exact line. For a filing, an audit or a client you need that dated result on your own files.
Ask about this tool
One question, answered by the person who built it. Your email only if you want the answer sent.