Introduction
When companies deploy Content Security Policy (CSP), HTTP Strict Transport Security (HSTS), or X-Content-Type-Options, there’s often a sense of closure — “security headers are in place, job done.”
But that mindset creates dangerous blind spots.
Security headers are not a one-time setup.
They are living configurations that must evolve with your frontend code, your vendors, and your threat model.
Why Headers Drift Over Time
Several forces cause header configurations to weaken or break:
- Frontend code changes (new scripts, domains, resources)
- Third-party vendors add functionality (e.g., live chat, analytics)
- Developers disable directives for testing — and never restore them
- Copy-paste reuse of old configurations without validation
- SaaS providers quietly update their CDN or subdomains
Result? Your once-perfect CSP or Permissions-Policy becomes either too permissive or non-functional.
Real-World Examples of Header Decay
- A CSP set two years ago still allows
unsafe-inlinebecause the site uses Vue — despite now using React with no need for inline scripts. - A company disables
frame-ancestorsfor a marketing embed — and leaves the door open for clickjacking attacks. - A site has Subresource Integrity (SRI) configured but loads newer libraries without integrity hashes.
Security headers don’t age well unless actively maintained.
What Headers Need Ongoing Attention
- Content-Security-Policy: Should reflect current script and resource usage
- Strict-Transport-Security: Requires consistent HTTPS support
- Permissions-Policy: Update as your site uses/excludes sensors, camera, location, etc.
- Referrer-Policy: Might need to change with tracking or marketing integration
- Cross-Origin-Embedder/Resource/Opener-Policy: Often impacted by third-party changes
How Breachfin Helps
Breachfin goes beyond simply flagging missing headers — it monitors for drift.
- Alerts when a security header is missing, weakened, or altered
- Tracks changes across time — even if a CDN silently disables one
- Maps header policies to browser behavior and PCI DSS 4.0 guidance
- Logs violations in real time from actual browser-based scans
With Breachfin, security headers are enforced, monitored, and reportable.
Final Thoughts
Think of security headers as policies — not static lines of config.
They must match what your site actually does, not what it used to do.
If you’re not auditing headers regularly, you’re not secure — just lucky.
Breachfin makes header hygiene part of your client-side observability strategy.
