security-headers 🔒#

HTTP security headers auditor with grading and info leak detection.

Commands#

bash

# Check one or more sites (auto-adds https://)
python3 scripts/headers.py github.com example.com

# JSON output
python3 scripts/headers.py --json example.com

Checks (9 headers)#

• 🔴 High: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP)
• 🟡 Medium: X-Content-Type-Options, X-Frame-Options, Referrer-Policy
• 🟢 Low: Permissions-Policy, X-XSS-Protection, COOP, CORP

Grading#

• A (≥78%): 7+ headers present
• B (≥56%): 5-6 headers
• C (≥33%): 3-4 headers
• D (≥11%): 1-2 headers
• F (0%): No security headers

Info Leak Detection#

Flags Server, X-Powered-By, X-AspNet-Version, X-Generator headers that reveal technology stack.