How is the Web Application Headers Risk Vector Assessed?

The Web Application Headers risk vector is part of the Diligence risk category. It analyzes a variety of headers and their configurations to determine if security best practices are being followed. The entire header configuration (not individual errors) is analyzed.

See how the Diligence risk category is calculated.

Resources

Configuration Requirements

Requirements for configuring headers.

Finding Grades

How Web Application Header findings are graded. Learn more about finding grades.

Finding Messages

Details about the finding and remediation instructions.

Required & Optional Headers

Assessed headers.

Web Application Header Concepts

Insufficient Data

A default risk vector grade is assigned if there is insufficient or no data.

Default: [No Impact] – WAH was replaced with WAS in the RAU25 and will be deprecated. It is a non-graded risk vector and is assigned with an N/A grade.

Behavior:

• Some findings cannot be traced back to specific companies due to the use of third party systems; such as web filters and Content Delivery Networks (CDN), that are capable of redirecting and encapsulating network traffic. Some firewalls might also be detecting and blocking external scanning tools from getting any data.
• If there are no findings and we are temporarily unable to collect data, the most recent grade is assigned for up to 340 days before being assigned the default grade.

Lifetime

Lifetime is the number of days a finding impacts the risk vector grade, assuming nothing changes in the future and the finding is not updated with new information. This is defined by the number of days a finding will impact the risk vector grade. Learn why findings have a decay and lifetime period.

Duration: 60 Days

Weight

Though the Web Application Headers risk vector is part of the Diligence risk category, which aggregates the weights of all risk vectors in the category to 70.5% towards Bitsight Security Ratings, this is an informational risk vector.

Weight: Not Applicable