Security Headers Lint - CSP and Dead Headers

Four header lines, four errors - for web and platform engineers who keep security headers in the repo and have to show a working policy at a PCI DSS assessment.

_headers
   3  ERROR Dead header. Chrome removed the XSS Auditor in 2019, Edge followed...
   4  ERROR ALLOW-FROM was only ever implemented by IE and old Firefox...
   5  ERROR HTTP Public Key Pinning is gone. Chrome removed it in 2019...
   6  ERROR CSP keywords are only keywords inside single quotes. Written bare...
   6  WARN  script-src * or https: permits script from any host on the web...
   6  INFO  default-src does not cover base-uri, form-action, frame-ancestors...

That is a real run over a _headers file copied from a 2019 blog post. Six findings, four of them errors - and none of them would fail a deploy, a curl, or a browser console. A wrong header does not error: it is served, parsed, and the wrong part is quietly dropped.

Line 6 is the one that catches almost everyone.

Content-Security-Policy: default-src self

CSP keywords are only keywords inside single quotes. Written bare, self is parsed as a host name - the browser goes looking for a server literally called self. No console error, no failed request. The same trap applies to none, unsafe-inline and strict-dynamic.

Lines 3, 4 and 5 are a different layer: headers that are simply dead. X-XSS-Protection has done nothing since Chrome removed the XSS Auditor in 2019. Public-Key-Pins was removed in 2019 too, and Expect-CT stopped being enforced in 2022 because Certificate Transparency is now unconditional. X-Frame-Options: ALLOW-FROM was never implemented in Chrome or Safari, so an invalid X-Frame-Options can leave the page framable by anyone.

Then there is the layer the browser throws away on purpose. frame-ancestors, sandbox and report-uri are discarded when a policy arrives in a <meta http-equiv> tag, because those three must apply before the document starts parsing. The rest of the policy still works, so the page looks protected and stays framable.

Two more cost real money. Feature-Policy was renamed to Permissions-Policy, and geolocation 'none' became geolocation=(). Permissions-Policy is a structured field, so the old quoted spelling is a parse error - and a browser that cannot parse a structured header discards the entire header, sending every permission on the line back to its default. And Strict-Transport-Security: max-age=600; preload is refused by the preload list, which requires at least 31536000 seconds plus includeSubDomains: you ship the token for years and were never on the list.

Why does this keep happening? CSP Evaluator and Observatory grade a URL that is already deployed, so every fix costs a deploy cycle and neither sees the config file where the mistake lives. And the fastest source of a header is now an assistant: they still emit X-XSS-Protection, report-uri and bare self, because those were correct when the training data was collected.

So this is a linter, not a scanner. It reads _headers, netlify.toml, vercel.json, nginx or Apache config: 28 rules, one per silent failure, each naming the behaviour you got, not the one you wrote.

If you take card payments this became an audit finding. PCI DSS v4.0.1 requirements 6.4.3 and 11.6.1 have been mandatory since 31 March 2025, and 11.6.1 covers detecting unauthorised changes to HTTP headers on the payment page. The assessor reads the headers you shipped, not the ones you meant.

Run it on the config you have open now - free, in VS Code or the browser, all 28 rules, every finding shown, nothing withheld. A licence is $29 once with a 7-day full refund, and it buys a different job, not more of the same: the whole workspace in one command, an exported CSV, JSON or HTML evidence file, and a CI gate. For comparison, an AppSec consultant billing $120-275 an hour spends one to two hours per site.