HTTP Security Headers Analyzer

Analyze HTTP response headers for security best practices. Grade websites A-F with actionable recommendations.

Quick Scan (Single URL)

python3 scripts/scan_headers.py <url>

Batch Scan (Multiple URLs)

python3 scripts/scan_headers.py <url1> <url2> <url3>

Output Formats

# Text (default)
python3 scripts/scan_headers.py <url>

# JSON
python3 scripts/scan_headers.py <url> --format json

# Markdown report
python3 scripts/scan_headers.py <url> --format markdown

What It Checks

Security Headers (15 checks)

Negative Indicators (penalize)

• Server header revealing version info
• X-Powered-By header present
• X-AspNet-Version or similar tech disclosure

Grading

• A+ (100): All critical+high headers present with optimal config
• A (90-99): All critical headers, minor improvements possible
• B (75-89): Most headers present, some gaps
• C (60-74): Several missing headers
• D (40-59): Major security gaps
• F (<40): Critical headers missing

CI Integration

Exit codes:

• 0 — Grade A or better
• 1 — Grade B-C (warnings)
• 2 — Grade D-F (failures)

Use --min-grade B to set custom threshold:

python3 scripts/scan_headers.py https://example.com --min-grade B

Workflow

1. User provides URL(s) to scan
2. Run the scan script
3. Present the grade and findings
4. Highlight critical missing headers first
5. Provide specific fix recommendations (Nginx, Apache, Cloudflare snippets)