A Python-based HTTP security header auditing tool that identifies weak or missing security headers across one or more web applications. It generates OWASP-aligned remediation guidance, severity ratings, and exports JSON + HTML reports suitable for AppSec teams, vulnerability assessments, and developer handoff.

This tool automates the security header review process and accelerates security assessments.

http-header-analyzer/
│── src/
│   └── header_analyzer.py
│── reports/
│   └── .gitkeep
│── wordlists/
│   └── .gitkeep
│── README.md
│── LICENSE

Checks for the industry-standard security headers:

• Content-Security-Policy (CSP)
• Strict-Transport-Security (HSTS)
• X-Frame-Options
• X-Content-Type-Options
• Referrer-Policy
• Permissions-Policy

Each missing header includes:

• Severity (HIGH / MEDIUM / LOW)
• Description
• Recommended fix aligned with OWASP best practices

Scan:

• A single URL
• Multiple URLs
• A .txt file containing URLs

Automatically generates:

• JSON report (header-report-*.json)
• HTML report (header-report-*.html)

Ideal for client deliverables.

Clear and readable terminal output with severity-based highlighting.

URLs automatically corrected to https:// when needed.

python3 src/header_analyzer.py https://example.com

python3 src/header_analyzer.py https://site1.com https://site2.org https://site3.net

targets.txt:

https://example.com
https://app.test.com
https://login.internal

Run:

python3 src/header_analyzer.py targets.txt

=== https://example.com ===
Status: 200

[+] Content-Security-Policy (OK)
[-] Strict-Transport-Security MISSING | Severity: HIGH
[-] X-Frame-Options MISSING | Severity: MEDIUM

Inside /reports/:

header-report-20251114-153210.json
header-report-20251114-153210.html

Ensures http:// or https:// prefix is applied automatically.

Uses a modern User-Agent and timeout protection.

For each of the 6 key security headers:

• Check presence
• Identify severity
• Provide OWASP remediation text

Stores:

• Present headers
• Missing headers
• Raw header dump
• Status code

Creates:

• JSON structured report
• HTML formatted table with severity coloring

The tool follows OWASP best practices for headers:

• CSP: Prevents XSS & injection
• HSTS: Prevents downgrade attacks
• XFO: Stops clickjacking
• XCTO: Prevents MIME sniffing
• Referrer-Policy: Reduces data leakage
• Permissions-Policy: Restricts browser features

(Automatically generated)

+--------------------------------------------------------------+
|               HTTP Security Header Report                    |
+--------------------------------------------------------------+
| URL: https://example.com                                     |
| Status: 200                                                  |
|--------------------------------------------------------------|
| Missing Headers:                                             |
|    HSTS – HIGH severity – remediation text...                |
|    X-Frame-Options – MEDIUM severity – remediation text...   |
| Present Headers:                                             |
|    Content-Security-Policy – HIGH severity (OK)             |
+--------------------------------------------------------------+

• Scan recursion for pages discovered via sitemap
• CSP quality scoring
• Response header entropy checks
• Policy misconfiguration detection
• Passive fingerprinting detection

This tool is intended for authorized security testing and educational use only. Analyzing systems without permission is illegal and unethical.

Vignesh Mani Offensive Security Researcher GitHub: https://github.com/vigneshoffsec LinkedIn: https://linkedin.com/in/vignesh-m17