Research Scanner

Last updated: 20 October 2026

If you found HeaderLabResearch/1.0 in your logs: it is a small, polite measurement of HTTP security headers on popular websites in Turkey. It makes a handful of ordinary page requests per site, reads the response headers, and moves on. Nothing is attacked, submitted, or logged into.

What it measures

How widely security headers such as Content-Security-Policy, Strict-Transport-Security, X-Frame-Options and Referrer-Policy are used, and whether the Content Security Policies in use actually protect against script injection. The results are compared with an earlier study of Turkish websites published in 2016.

What it does on your site

  • One GET request to http:// and one to https:// on your home page, following redirects.
  • The same for up to ten subdomains that your home page links to.
  • At least two seconds between consecutive requests to the same site, and only a few sites at a time.
  • No forms, no logins, no query parameters, no vulnerability tests, no crawling beyond those pages.

The full source code is public in our repository.

What is kept and how it is reported

The scanner stores the response headers, the redirect chain, and a SHA-256 hash of the page; the page content itself is not stored. Results are reported in aggregate, by sector. Individual websites are not named in any publication, and weak configurations are never singled out.

Opting out

To have your domain excluded from current and future runs, write to hello@headerlab.dev with the domain name. We will remove it from the scan list and delete any stored data for it.

User agent

Requests identify themselves with a current Chrome user agent string followed by HeaderLabResearch/1.0 (+https://headerlab.dev/research). The browser part is there because some firewalls reject unknown clients outright, which would hide the headers a real visitor receives.