Check HTTP security headers and TLS configuration. Find missing protections and misconfigurations.
# Analyze a single URL
python3 {baseDir}/scripts/analyze-headers.py https://example.com
# Check multiple targets
python3 {baseDir}/scripts/analyze-headers.py -f urls.txt
# JSON output
python3 {baseDir}/scripts/analyze-headers.py https://example.com --json
| Header | Purpose | Risk if Missing |
|---|---|---|
| -------- | --------- | ----------------- |
Strict-Transport-Security | Forces HTTPS | Medium |
Content-Security-Policy | XSS protection | Medium-High |
X-Frame-Options | Clickjacking protection | Medium |
X-Content-Type-Options | MIME sniffing protection | Low |
X-XSS-Protection | XSS filter (legacy) | Low |
Referrer-Policy | Controls referrer leakage | Low |
Permissions-Policy | Feature restrictions | Low |
Cross-Origin-Opener-Policy | Cross-origin isolation | Low |
Cross-Origin-Embedder-Policy | Cross-origin isolation | Low |
Cross-Origin-Resource-Policy | Cross-origin protection | Low |
URL — Target URL(s) to analyze-f FILE — File with URLs (one per line)--json — JSON output--follow — Follow redirects (default: yes)--timeout SECS — Request timeout (default: 10)--user-agent UA — Custom User-Agent--check-tls — Also check TLS certificate info--severity LEVEL — Minimum severity to report: low, medium, high=== https://example.com ===
✅ Strict-Transport-Security: max-age=31536000; includeSubDomains
✅ Content-Security-Policy: default-src 'self'
❌ X-Frame-Options: MISSING (clickjacking risk)
✅ X-Content-Type-Options: nosniff
❌ Referrer-Policy: MISSING
⚠️ Server: nginx/1.18.0 (version exposed)
Score: 3/6 security headers present
Risk: MEDIUM
共 1 个版本