A lightweight Python CLI tool that fetches and analyzes HTTP security headers according to Mozilla and OWASP best practices. This tool is designed for developers, penetration testers, and system administrators who want a quick, reliable way to evaluate the security posture of a website's HTTP response headers.
- 9 Security Header Analyzers: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COEP, COOP, CORP
- SSRF Protection: Built-in safeguards against Server-Side Request Forgery attacks
- Multiple Output Formats: Human-readable text or JSON for automation
- Severity Classification: Issues categorized as Critical, High, Medium, or Low
- 96% Test Coverage: 291 comprehensive tests ensuring reliability
- Type Safety: Full type hints with mypy support
- CI/CD Ready: Easy integration with GitHub Actions, GitLab CI, Jenkins
- Extensible: Add new header analyzers with minimal code changes
Clone the repository and install dependencies:
git clone https://github.com/itheCreator1/security-header-analyzer
cd security-header-analyzer
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txtOptionally install in development mode:
pip install -e .Run the analyzer from the command line:
python -m sha https://example.com--json Outputs results in JSON format
--timeout 10 Sets request timeout
--no-redirects Disables following HTTP redirects
--user-agent "MyBot" Uses a custom User-Agent
--debug Shows verbose debug logs
- Architecture Guide - System design, components, and extensibility
- API Documentation - Library usage and programmatic access
- Analyzer Reference - Detailed header analysis specifications
- Testing Guide - Running and writing tests
- Deployment Guide - CI/CD integration and production deployment
- Contributing - Development workflow and guidelines
- Security Policy - Vulnerability reporting and security considerations
- Changelog - Version history and release notes
security-header-analyzer/
├── sha/ # Main package
│ ├── __init__.py # Package initialization
│ ├── __main__.py # Module entry point
│ ├── main.py # CLI entry point
│ ├── fetcher.py # HTTP header fetching with SSRF protection
│ ├── analyzer.py # Analysis orchestration
│ ├── reporter.py # Report generation (text/JSON)
│ ├── config.py # Configuration and exceptions
│ └── analyzers/ # Individual header analyzers (9 total)
├── tests/ # Comprehensive test suite (291 tests, 96% coverage)
├── docs/ # Documentation
└── .github/ # CI/CD workflows
Use as a Python library in your own code:
from sha.fetcher import fetch_headers
from sha.analyzer import analyze_headers
from sha.reporter import generate_report
# Fetch and analyze
headers = fetch_headers("https://example.com")
findings = analyze_headers(headers)
# Generate report
report = generate_report(findings, url="https://example.com", format="json")
print(report)See API Documentation for complete reference.
The analyzer follows guidance from:
- Mozilla Web Security Guidelines
- OWASP Secure Headers Project
Security Features:
- SSRF protection against private IP ranges
- DNS rebinding validation
- SSL/TLS certificate verification
Known Limitations:
- TOCTOU vulnerability in DNS resolution (documented in SECURITY.md)
- Do not expose as public API without additional safety measures
# Run all tests
pytest
# With coverage
pytest --cov=sha --cov-report=html
# Run specific test
pytest tests/test_hsts.py -vSee Testing Guide for details.
Contributions are welcome! Please read CONTRIBUTING.md for:
- Development setup
- Coding standards
- Testing requirements
- Pull request process
- Version: 1.0.0
- Python: 3.8, 3.9, 3.10, 3.11, 3.12
- Tests: 291 passing
- Coverage: 96%
- License: MIT
MIT License - See LICENSE for details
Made with security in mind 🔒