HeaderSec extension: confirm the origin before you scan

Picture a sensible moment to check security headers: you are signed in to a site you operate, several levels deep, on a URL that carries a session-specific path and a query string you would rather not paste anywhere. Copying that address into a scanner means trimming it by hand or typing the hostname again. Neither is hard. If the check depends on that extra step, though, it is easy to leave it for later.

The scan starts from the origin, not the page

The HeaderSec extension for Chrome shortens that step without passing the rest of the address along. Open the popup and it shows the public origin of the active tab, meaning the scheme, hostname and port. Confirm that is the site you intend to check, choose Scan security headers, and HeaderSec’s server requests that origin and reads the public response headers. The scan request carries only the origin. The extension does not send the path, query, fragment, page content, cookies or form entries to HeaderSec, and it does not install a content script or scan in the background. HeaderSec is owned by VMCSoft Digital and published and operated by ViWeb Technology.

Confirming the origin matters because of what the scan is. It is a fresh, server-side request to the public site, not an inspection of the response your signed-in tab already received. If an authenticated area sends a different header set from the public front door, the scan reports the front door. What you get is the response HeaderSec’s server received for that origin at that moment. A visitor on a different route, location or browser may receive something different, and the logged-in page you are looking at is not what was checked. Internal, private and localhost targets are outside what the service will scan. The support page explains the Website unavailable message and what to do when the service asks you to continue verification on the site.

Reading an older result

Reopen the popup on the same origin later and it may show a saved summary labelled Last result. That label is doing real work. It is the outcome of an earlier scan, restored for convenience, and not evidence about the site as it stands now. After a deploy, a CDN rule change or a hosting move, choose Scan again and read the fresh result. The saved summary holds the grade, score, counts and a few finding titles for that origin, not the full headers; the full report lives on HeaderSec under a hard-to-guess URL that anyone holding it can open and that can become unavailable after retention cleanup. Do not scan an origin whose public headers you would not want in such a report.

Sign-in with GitHub is optional and associates scans with a HeaderSec account. Anonymous scans work without it. The privacy policy is the reference for what the extension keeps locally and what the service stores.

A good grade is evidence about browser-side controls. It is not a certification, and it says nothing about application logic, access control or the infrastructure underneath. For the habit of scanning after each change, the earlier post on checking the response after the change covers the reasoning. The extension’s contribution is narrower: when you are already on the site, confirm the origin, scan, and know which response you are reading.