HTTP response header checker

HTTP Strict Transport Security (HSTS) with the preload directive instructs browsers to refuse unencrypted HTTP connections and disallow certificate error overrides. When a guest connects to WiFi and attempts to open an HSTS-preloaded domain (such as google.com), the wireless controller's HTTP interception cannot present a valid certificate for that domain. The browser displays a hard SSL warning instead of redirecting to the captive portal. Modern networks use RFC 8908 Captive Portal API or Apple/Android captive portal probe domains (such as captive.apple.com) which intentionally omit HSTS.

Captive portal splash pages require a balanced CSP that allows essential authentication assets while preventing cross-site scripting (XSS). The policy should permit scripts and styles from trusted CDNs and social login identity providers (such as Google, Apple, and Microsoft), while restricting default-src 'self' and disallowing untrusted inline script execution. In addition, social auth redirect domains must be whitelisted in the network controller's Walled Garden.

The X-Frame-Options: DENY or SAMEORIGIN header (and the modern CSP frame-ancestors directive) prevents malicious third-party websites from rendering the captive portal login form inside an invisible iframe. This eliminates clickjacking attacks where attackers trick visitors into submitting login credentials or social authorization tokens.

An HTTP 302 Found redirect is commonly used by legacy network controllers to redirect initial HTTP requests to the splash page URL, but clients may switch POST requests to GET. An HTTP 307 Temporary Redirect guarantees that the HTTP method and request body remain unchanged during redirection. For modern captive networks, RFC 8908 provides a standardized JSON endpoint that eliminates HTTP interception entirely.

The X-Content-Type-Options: nosniff header forces browsers to adhere strictly to the MIME type declared in the Content-Type header. This prevents MIME-sniffing attacks where user-uploaded files or malicious text snippets are executed as executable JavaScript or CSS in vulnerable browsers.

Permissions-Policy (formerly Feature-Policy) allows site operators to disable sensitive hardware APIs such as camera, microphone, geolocation, and payment request within the browser context. Disabling unused device features on guest WiFi landing pages reassures visitors that the portal respects data privacy standards.