HTTP Security Headers Analyzer#

Analyze HTTP response headers for security best practices. Grade websites A-F with actionable recommendations.

Quick Scan (Single URL)#

bash

python3 scripts/scan_headers.py <url>

Batch Scan (Multiple URLs)#

bash

python3 scripts/scan_headers.py <url1> <url2> <url3>

Output Formats#

bash

# Text (default)
python3 scripts/scan_headers.py <url>

# JSON
python3 scripts/scan_headers.py <url> --format json

# Markdown report
python3 scripts/scan_headers.py <url> --format markdown

What It Checks#

Security Headers (15 checks)#

HeaderImpactDescriptionStrict-Transport-SecurityCriticalHTTPS enforcement, preload, max-ageContent-Security-PolicyCriticalXSS/injection prevention, directive analysisX-Frame-OptionsHighClickjacking protectionX-Content-Type-OptionsHighMIME sniffing preventionReferrer-PolicyMediumInformation leakage controlPermissions-PolicyMediumBrowser feature restrictionsX-XSS-ProtectionLowLegacy XSS filter (deprecated but checked)Cross-Origin-Opener-PolicyMediumCross-origin isolationCross-Origin-Resource-PolicyMediumResource sharing controlCross-Origin-Embedder-PolicyMediumEmbedding restrictionsCache-ControlMediumSensitive data cachingX-Permitted-Cross-Domain-PoliciesLowFlash/PDF cross-domainClear-Site-DataInfoLogout/session clearingX-DNS-Prefetch-ControlLowDNS prefetch controlContent-TypeHighCharset and MIME type

Negative Indicators (penalize)#

• Server header revealing version info
• X-Powered-By header present
• X-AspNet-Version or similar tech disclosure

Grading#

• A+ (100): All critical+high headers present with optimal config
• A (90-99): All critical headers, minor improvements possible
• B (75-89): Most headers present, some gaps
• C (60-74): Several missing headers
• D (40-59): Major security gaps
• F (<40): Critical headers missing

CI Integration#

Exit codes:

• 0 — Grade A or better
• 1 — Grade B-C (warnings)
• 2 — Grade D-F (failures)

Use --min-grade B to set custom threshold:

bash

python3 scripts/scan_headers.py https://example.com --min-grade B

Workflow#

1. User provides URL(s) to scan
2. Run the scan script
3. Present the grade and findings
4. Highlight critical missing headers first
5. Provide specific fix recommendations (Nginx, Apache, Cloudflare snippets)