Http Sec Audit

Name: Http Sec Audit
Author: luokai0

ASecurity

Audit HTTP security headers for any website. Use when a user asks to check security headers, harden a web server, audit HSTS/CSP/X-Frame-Options compliance, find information leaks (Server, X-Powered-By), or assess a website's security posture. Checks 10 security headers and grades A–F. Supports multiple URLs and JSON output.

11 stars
0 votes
0 copies
2 views
Added September 10, 2026

securitypythongobashgitsecurity

Security analysis

A96/100

mediumInstalls packages at runtime which could introduce malicious dependencies

Pro shows the line behind each finding and how to fix it

Scanned September 10, 2026

npx -y skills add luokai0/ai-agent-skills-by-luo-kai --skill http-sec-audit --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Http Sec Audit?

Add the live security badge to your README. It updates with every re-scan.

[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/luokai0-http-sec-audit/badge)](https://www.skillsdirectory.com/skills/luokai0-http-sec-audit)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

SKILL.md

---
name: http-sec-audit
description: Audit HTTP security headers for any website. Use when a user asks to check security headers, harden a web server, audit HSTS/CSP/X-Frame-Options compliance, find information leaks (Server, X-Powered-By), or assess a website's security posture. Checks 10 security headers and grades A–F. Supports multiple URLs and JSON output.
---

# HTTP Security Headers Audit

Scan any URL for missing or misconfigured security headers and get an actionable report with grades, fix recommendations, and info-leak detection.

## Quick Start

```bash
python3 scripts/sec_headers.py https://example.com
```

## Commands

```bash
# Single URL audit
python3 scripts/sec_headers.py https://example.com

# Multiple URLs
python3 scripts/sec_headers.py https://example.com https://google.com https://github.com

# JSON output (for programmatic use)
python3 scripts/sec_headers.py https://example.com --json

# Custom timeout
python3 scripts/sec_headers.py https://example.com --timeout 5
```

## What It Checks

**Security headers** (graded by severity):
- `Strict-Transport-Security` (HSTS) — HIGH
- `Content-Security-Policy` (CSP) — HIGH
- `X-Content-Type-Options` — MEDIUM
- `X-Frame-Options` — MEDIUM
- `Referrer-Policy` — MEDIUM
- `Permissions-Policy` — MEDIUM
- `X-XSS-Protection` — LOW
- `Cross-Origin-Opener-Policy` (COOP) — LOW
- `Cross-Origin-Resource-Policy` (CORP) — LOW
- `Cross-Origin-Embedder-Policy` (COEP) — LOW

**Info leak detection:**
- `Server` header (software version disclosure)
- `X-Powered-By` (technology stack leak)
- `X-AspNet-Version` (framework version leak)

## Grading

| Grade | Score | Meaning |
|-------|-------|---------|
| A | 90–100 | Excellent — all critical headers present |
| B | 75–89 | Good — minor gaps |
| C | 50–74 | Fair — important headers missing |
| D | 25–49 | Poor — significant exposure |
| F | 0–24 | Failing — most headers absent |

## Dependencies

```bash
pip install requests
```