It indicates missing, weak, contradictory, or overly permissive security headers (such as CSP, HSTS, X-Frame-Options, Permissions-Policy) that increase attack surface and are commonly observed in poorly maintained or auto-generated web setups.
The questions every analyst asks before acting on this signal.
It indicates missing, weak, contradictory, or overly permissive security headers (such as CSP, HSTS, X-Frame-Options, Permissions-Policy) that increase attack surface and are commonly observed in poorly maintained or auto-generated web setups.
This is a supporting malicious-context signal with a single tier. On its own it reflects weak hardening rather than proven abuse; it gains weight when correlated with risky cookie behavior, redirector chains or DNS volatility.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "http_security_header_anomaly",
"name": "Weak or Misconfigured Security Headers",
"group": "http_crawling_history",
"subgroup": "http_header_behaviors",
"direction": "malicious",
"evidence": {
"missing_security_headers": 4,
"cors_origin": "*",
"cors_credentials_allowed": true,
"provider_type": "self_hosted",
"risky_cookie_count": 2
}
}12 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It indicates weak or overly permissive CORS configurations such as wildcard origins, broad method or header allowances, …
It indicates that the site sets cookies issued by specific edge protection providers whose cookies appear far more often…
It indicates abnormal HTTP header structures such as unusually minimal or dense header sets, odd ordering, unexpected pr…
It indicates abnormal HTTP redirection patterns such as instant refresh redirects, header-based redirects, forced interm…
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
1,000 verdicts/month on the free tier, LLM layer included. No card required.