Uploaded July 2026 | Updated September 2026, 2 weeks ago
A Fistful of Headers: Taming the Wild Web at Scale
Presenters: Cary Hooper and Wesley McElhinny
How secure are the top 1 million websites?
In this session, Cary Hooper and Wesley McElhinny break down a large-scale study of HSTS adoption using a custom distributed scanning framework. By scanning one million domains, they reveal how websites actually implement security headers and where things go wrong.
You’ll see how the system works, from spinning up cloud workers to collecting and analyzing results, plus real examples of misconfigured or broken HSTS policies.
The talk also includes a live demo showing how attacks work in practice and how HSTS helps defend against them.
If you’re into web security, large-scale scanning, or systems design, this is a must-watch.
#cybersecurity #websecurity #infosec #hsts #cloudsecurity
///Black Hills Infosec Socials
Twitter: twitter.com/BHinfoSecurity
Mastodon: https://infosec.exchange/@blackhillsinfosec
LinkedIn: linkedin.com/company/antisyphon-training
Discord: discord.gg/ffzdt3WUDe
///Black Hills Infosec Shirts & Hoodies
spearphish-general-store.myshopify.com/collections/bhis-shirt-collections
///Black Hills Infosec Services
Active SOC: blackhillsinfosec.com/services/active-soc
Penetration Testing: blackhillsinfosec.com/services
Incident Response: blackhillsinfosec.com/services/incident-response
///Backdoors & Breaches - Incident Response Card Game
Backdoors & Breaches: backdoorsandbreaches.com
Play B&B Online: play.backdoorsandbreaches.com
///Antisyphon Training
Pay What You Can: antisyphontraining.com/pay-what-you-can
Live Training: antisyphontraining.com/course-catalog
On Demand Training: antisyphontraining.com/on-demand-course-catalog
Antisyphon Discord: discord.gg/antisyphon
Antisyphon Mastodon: https://infosec.exchange/@Antisy_Training
///Educational Infosec Content
Black Hills Infosec Blogs: blackhillsinfosec.com/blog
Wild West Hackin' Fest YouTube: youtube.com/wildwesthackinfest
Antisyphon Training YouTube: youtube.com/antisyphontraining
Active Countermeasures YouTube: youtube.com/activecountermeasures
Threat Hunter Community Discord: discord.gg/threathunter
Join us at the annual information security conference in Deadwood, SD (in-person and virtually) — Wild West Hackin' Fest: wildwesthackinfest.com
A Fistful of Headers: Taming the Wild Web at Scale
Presenters: Cary Hooper and Wesley McElhinny
How secure are the top 1 million websites?
In this session, Cary Hooper and Wesley McElhinny break down a large-scale study of HSTS adoption using a custom distributed scanning framework. By scanning one million domains, they reveal how websites actually implement security headers and where things go wrong.
You’ll see how the system works, from spinning up cloud workers to collecting and analyzing results, plus real examples of misconfigured or broken HSTS policies.
The talk also includes a live demo showing how attacks work in practice and how HSTS helps defend against them.
If you’re into web security, large-scale scanning, or systems design, this is a must-watch.
#cybersecurity #websecurity #infosec #hsts #cloudsecurity
///Black Hills Infosec Socials
Twitter: twitter.com/BHinfoSecurity
Mastodon: https://infosec.exchange/@blackhillsinfosec
LinkedIn: linkedin.com/company/antisyphon-training
Discord: discord.gg/ffzdt3WUDe
///Black Hills Infosec Shirts & Hoodies
spearphish-general-store.myshopify.com/collections/bhis-shirt-collections
///Black Hills Infosec Services
Active SOC: blackhillsinfosec.com/services/active-soc
Penetration Testing: blackhillsinfosec.com/services
Incident Response: blackhillsinfosec.com/services/incident-response
///Backdoors & Breaches - Incident Response Card Game
Backdoors & Breaches: backdoorsandbreaches.com
Play B&B Online: play.backdoorsandbreaches.com
///Antisyphon Training
Pay What You Can: antisyphontraining.com/pay-what-you-can
Live Training: antisyphontraining.com/course-catalog
On Demand Training: antisyphontraining.com/on-demand-course-catalog
Antisyphon Discord: discord.gg/antisyphon
Antisyphon Mastodon: https://infosec.exchange/@Antisy_Training
///Educational Infosec Content
Black Hills Infosec Blogs: blackhillsinfosec.com/blog
Wild West Hackin' Fest YouTube: youtube.com/wildwesthackinfest
Antisyphon Training YouTube: youtube.com/antisyphontraining
Active Countermeasures YouTube: youtube.com/activecountermeasures
Threat Hunter Community Discord: discord.gg/threathunter
Join us at the annual information security conference in Deadwood, SD (in-person and virtually) — Wild West Hackin' Fest: wildwesthackinfest.com
