HTTP Header Analyzer#

Check HTTP security headers and TLS configuration. Find missing protections and misconfigurations.

Quick Start#

bash

# Analyze a single URL
python3 {baseDir}/scripts/analyze-headers.py https://example.com

# Check multiple targets
python3 {baseDir}/scripts/analyze-headers.py -f urls.txt

# JSON output
python3 {baseDir}/scripts/analyze-headers.py https://example.com --json

Headers Checked#

HeaderPurposeRisk if MissingStrict-Transport-SecurityForces HTTPSMediumContent-Security-PolicyXSS protectionMedium-HighX-Frame-OptionsClickjacking protectionMediumX-Content-Type-OptionsMIME sniffing protectionLowX-XSS-ProtectionXSS filter (legacy)LowReferrer-PolicyControls referrer leakageLowPermissions-PolicyFeature restrictionsLowCross-Origin-Opener-PolicyCross-origin isolationLowCross-Origin-Embedder-PolicyCross-origin isolationLowCross-Origin-Resource-PolicyCross-origin protectionLow

Options#

• URL — Target URL(s) to analyze
• -f FILE — File with URLs (one per line)
• --json — JSON output
• --follow — Follow redirects (default: yes)
• --timeout SECS — Request timeout (default: 10)
• --user-agent UA — Custom User-Agent
• --check-tls — Also check TLS certificate info
• --severity LEVEL — Minimum severity to report: low, medium, high

Output#

text

=== https://example.com ===
✅ Strict-Transport-Security: max-age=31536000; includeSubDomains
✅ Content-Security-Policy: default-src 'self'
❌ X-Frame-Options: MISSING (clickjacking risk)
✅ X-Content-Type-Options: nosniff
❌ Referrer-Policy: MISSING
⚠️  Server: nginx/1.18.0 (version exposed)

Score: 3/6 security headers present
Risk: MEDIUM