Skip to content
NewVerdictIQ Connector is here. One Docker image enriches your DNS logs with verdicts inside your network and forwards them to your SIEM.Install guide

HTTP Header Behaviors

Response header posture: security headers, cookie flags, CORS policy, redirector and stack fingerprints, and the hosting or parking platform behind the response. Each fires with named evidence and a 3-question analyst Q&A trail.

See 13 HTTP Header Behaviors signalsSee verdicts firing these
About

What HTTP Header Behaviors captures

Response header posture: security headers, cookie flags, CORS policy, redirector and stack fingerprints, and the hosting or parking platform behind the response. Tier-1 SOC analysts use them to cut triage time on suspicious http crawling history behavior; CTI teams pivot from them to the broader campaign graph.

Browse

13 signals in HTTP Header Behaviors

Each row opens a leaf page with the signal's direction, named evidence, and 3-question Q&A trail. Use them as audit anchors when a verdict surfaces this subgroup.

HTTP Header Behaviors13 signals
Verdict scenarios

How HTTP Header Behaviors shapes the call

Three real-world situations where HTTP Header Behaviors evidence dominates the decision. Verdict and explanation are how VerdictIQ would frame the outcome to an analyst, not raw signal slugs.

High riskVERDICT · BLOCK
The situation

A site whose headers carry a suspicious redirector and header-structure fingerprint, with wildcard CORS and credentials allowed.

VerdictIQ explains

“Decline. The headers describe a relay built to pass traffic along, and the CORS policy leaves any origin free to read responses.”

Medium riskVERDICT · REVIEW
The situation

A site missing most standard security headers and setting long-lived profiling cookies without the Secure or HttpOnly flags.

VerdictIQ explains

“Send to analyst review. Weak headers alone are common on small sites; confirm whether the cookie profile is careless or collecting on purpose.”

Low riskVERDICT · ALLOW
The situation

A site on a managed platform with a full security header set, a standard framework session cookie stack, and a rich custom header set.

VerdictIQ explains

“Allow. The header posture matches a maintained production property. No header reason to delay.”

See full Verdict Gallery
Sibling subgroups

Other subgroups in HTTP Crawling History

6 more subgroups in this group, each bundling signals that share a different mechanism. Tap one to inspect its signal names.

See subgroup detail
See subgroup detail
See subgroup detail
See subgroup detail
See subgroup detail
See subgroup detail

See HTTP Header Behaviors signals fire on your data

Free tier: 1,000 verdicts/month, LLM layer included.

Start FreeBack to HTTP Crawling History