Security Headers Analyzer

Analyze and score website security headers with remediation suggestions.

Features

• Header Analysis: CSP, HSTS, X-Frame-Options, etc.
• Security Scoring: Grade websites A-F
• Remediation Guide: Fix security issues
• Batch Scanning: Scan multiple domains
• Historical Tracking: Monitor improvements
• CI/CD Ready: Automated scanning

Analyzed Headers

• Content-Security-Policy (CSP)
• Strict-Transport-Security (HSTS)
• X-Frame-Options
• X-Content-Type-Options
• Referrer-Policy
• Permissions-Policy
• X-XSS-Protection
• Cross-Origin-Embedder-Policy (COEP)
• Cross-Origin-Opener-Policy (COOP)
• Cross-Origin-Resource-Policy (CORP)

Tech Stack

• TypeScript/Node.js
• axios
• CSP Parser
• CLI with commander

Usage

npm install -g security-headers-analyzer

sec-headers check https://example.com
sec-headers batch --file domains.txt
sec-headers monitor --url https://example.com --schedule daily

Example Output

🔒 Security Headers Analysis
━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Domain: example.com
Overall Grade: B+

✓ HSTS: Enabled (max-age=31536000)
✗ CSP: Missing - CRITICAL
✓ X-Frame-Options: DENY
✓ X-Content-Type-Options: nosniff
⚠ Referrer-Policy: Not set - WARNING

Recommendations:
1. Add Content-Security-Policy header
2. Set Referrer-Policy to strict-origin-when-cross-origin

License

MIT