Summary
Explore how to test web application security headers effectively using tools like WebPageTest, Lighthouse, and Check My Headers CLI. Understand how these tools help identify security issues, and discover how to automate testing by integrating them with continuous integration systems to maintain ongoing security monitoring.
We'll cover the following...
We looked at several tools to help us find security issues in web applications:
- WebPageTest: An online web performance and security scanning tool for websites.
- Lighthouse: Browser-based web assessment tool for performance, accessibility, security, and more.
- Check My Headers CLI app: a handy command-line Node.js application to test a website’s headers.
Test yourself
Let’s see how well you know the tools we reviewed.
WebPageTest assessment
WebPageTest helps with
Testing for performance issues in websites
Testing for security issues in websites
Testing for performance and security issues in websites and giving insights into how to fix them
Lighthouse
Lighthouse is available via Chrome DevTools and helps with: Multi-select
Finding performance issues
Finding security issues
Finding SEO and Web Accessibility issues
Finding issues with Progressive Web Apps
Keeping up with security
What are some ways you can make sure you have no regressions in your security headers setup? Multi-select
Run tools like check-my-headers in the Continuous Integration systems to fail the build if a regression happens
In an End-to-End Continuous Integration setup, use the WebPageTest API to schedule tests of the website and ensure the security score is the same, or better
Run a security penetration test after the web application is published
What’s next?
If you’d like to keep security in check, you should automate the process to keep up with the scale of development. All of the above tools have APIs or integration points that you can connect to continuous integration systems.