Security Headers Checker Overlay on Any Page

WHAT IT DOES

Security Headers Checker Overlay on Any Page scans the current page for HTTP security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, etc.) by examining the page's response headers and meta tags. The floating panel displays a security headers dashboard showing which headers are present, their values, and compliance status. Color-coded indicators (green for present/secure, yellow for partial/weak, red for missing), a summary security score, and recommendations for missing or misconfigured headers are provided. Export header analysis as CSV or text, and track header configurations over time for the current domain.

WHERE IT RUNS

Works on any web page, including HTTP and HTTPS sites, security dashboards, and development environments. The script detects headers from meta tags and available response headers. It works on any page regardless of domain.

HOW TO USE

The panel displays a security score badge showing the overall security posture, followed by a list of all detected security headers. Each header shows its name, value, status (Present/Partial/Missing), and a description. Critical headers are marked with a warning icon. Recommendations are provided for missing or misconfigured headers. Click "Scan Headers" to refresh the analysis, and export the report as text for documentation. The panel tracks scan history per domain for reference.

MECHANISM — HEADER DETECTION WITH SCORING AND RECOMMENDATIONS

The script detects security headers from two sources: meta tags (http-equiv) and available response headers from the page. It checks against a comprehensive list of security headers including CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COEP, COOP, and CORP. Each header has a defined criticality weight (critical = 3, non-critical = 1). The security score is calculated as the weighted sum of header statuses: present (100% of weight), partial (50%), or missing (0%). The score is normalized to 0-100%. Recommendations are generated based on missing critical headers and partial configurations. All detection and scoring runs client-side with no network calls.

THE PANEL

The floating panel is fully draggable and remembers its position per domain. Click the minimize button to collapse it to a small bubble, or press Escape to hide it. The panel automatically adjusts to different screen sizes and can be resized to show more content. All settings, including score thresholds and scan history, are saved per domain. The panel integrates smoothly with any page layout using the BGPanel framework, maintaining clean separation from page content.

PLEASE NOTE

This script requires the free BotGentz extension to run. It does not send any data to external servers; all extracted header data, scan history, and settings remain entirely local to your browser using GM_setValue. The script never reads password fields, hidden inputs, or file inputs. It stores only header names, values, statuses, and timestamps from publicly visible page content and meta tags. Header detection depends on the page structure and available response headers; not all headers may be detectable. The script works on any page and detects pages by hostname for history tracking. Security scores are based on a weighted model and should be used as a reference. Data persists across browser sessions and is isolated per browser profile.