A Python-based tool for analyzing and validating the security headers of websites. This tool helps developers and security professionals identify missing, misconfigured, or properly configured HTTP security headers to enhance website security.

• Detailed Analysis: Checks for the presence and configuration of critical HTTP security headers.
• HSTS Validation: Evaluates the Strict-Transport-Security header against best practices:
  • A minimum max-age of 31536000 seconds (1 year).
  • The presence of the includeSubDomains directive.
  • Support for the preload directive.
• Report Generation: Generates detailed reports in multiple formats (JSON, CSV, and human-readable table).
• JSON, CSV, and Table Output: Provides structured results for easy integration or reporting.

• Python 3.7+
• pip (Python package manager)

1. Clone the repository:

   git clone https://github.com/your-username/SecHeadChecker.git
   cd SecHeadChecker

2. Install dependencies:

   pip install -r requirements.txt

Run the tool by providing the target domain as a command-line argument:

python3 main.py <domain>

python3 main.py example.com

Sample Output:

{
    "domain": "https://example.com",
    "headers": [
        {
            "header": "Content-Security-Policy",
            "status": "Present",
            "details": "default-src 'self'; script-src 'none';"
        },
        {
            "header": "Strict-Transport-Security",
            "status": "Configured",
            "details": {
                "max-age": true,
                "includeSubDomains": true,
                "preload": false
            }
        },
        ...
    ]
}

security-header-checker/
│
├── main.py                  # Entry point of the application
├── reports/                 # Folder to store the generated reports
├── utils/
│   ├── header_checker.py    # Core logic for security header analysis
│   ├── hsts_checker.py      # Validation logic for HSTS headers
│   ├── report_writer.py     # Logic for saving reports (JSON, CSV, Table)
│   └── status_code_checker.py # Logic for analyzing HTTP status codes
├── requirements.txt         # Python dependencies
└── README.md                # Project documentation

The project uses the following Python library:

• requests: Handles HTTP requests.

Install dependencies using:

pip install -r requirements.txt

requests
colorama
tabulate
prettytable

1. The tool sends an HTTP GET request to the target domain.
2. It retrieves the HTTP response headers.
3. Each header is analyzed for presence, correctness, and configuration:
   • If the header is missing, it is flagged as "Missing".
   • If present, additional checks are performed for specific headers (e.g., HSTS).
4. Outputs results in a structured JSON format.

This project is licensed under the MIT License.