360 Secure SkillHub
360 安全技能中心

HTTP Security Headers

该 Skill 通过 Python 脚本抓取一个或多个 URL 的 HTTP 响应头，检查 HSTS、CSP、X-Frame-Options 等安全头及负面指标，给出 A-F 评级、文本/JSON/Markdown 结果和修复建议，并支持批处理与 CI 阈值。

charlie-morrison
charlie-morrison
热度 49.77
最近更新 2026-05-11 17:42:01
分类：安全依赖：代码执行应用场景：报告撰写 / DevOps

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add http-security-headers
Metadata
name
http-security-headers
description
Analyze HTTP security headers for any URL. Check for HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, CORS, and more. Assign A-F security grades with OWASP-aligned recommendations. Use when asked to check security headers, audit HTTP headers, scan a website for security, check HSTS/CSP configuration, grade website security posture, or review HTTP response security. Triggers on "security headers", "check headers", "HSTS", "CSP audit", "website security scan", "header analysis", "security grade".

HTTP Security Headers Analyzer

Analyze HTTP response headers for security best practices. Grade websites A-F with actionable recommendations.

Quick Scan (Single URL)

python3 scripts/scan_headers.py <url>

Batch Scan (Multiple URLs)

python3 scripts/scan_headers.py <url1> <url2> <url3>

Output Formats

# Text (default)
python3 scripts/scan_headers.py <url>

# JSON
python3 scripts/scan_headers.py <url> --format json

# Markdown report
python3 scripts/scan_headers.py <url> --format markdown

What It Checks

Security Headers (15 checks)

Header Impact Description
Strict-Transport-Security Critical HTTPS enforcement, preload, max-age
Content-Security-Policy Critical XSS/injection prevention, directive analysis
X-Frame-Options High Clickjacking protection
X-Content-Type-Options High MIME sniffing prevention
Referrer-Policy Medium Information leakage control
Permissions-Policy Medium Browser feature restrictions
X-XSS-Protection Low Legacy XSS filter (deprecated but checked)
Cross-Origin-Opener-Policy Medium Cross-origin isolation
Cross-Origin-Resource-Policy Medium Resource sharing control
Cross-Origin-Embedder-Policy Medium Embedding restrictions
Cache-Control Medium Sensitive data caching
X-Permitted-Cross-Domain-Policies Low Flash/PDF cross-domain
Clear-Site-Data Info Logout/session clearing
X-DNS-Prefetch-Control Low DNS prefetch control
Content-Type High Charset and MIME type

Negative Indicators (penalize)

  • Server header revealing version info
  • X-Powered-By header present
  • X-AspNet-Version or similar tech disclosure

Grading

  • A+ (100): All critical+high headers present with optimal config
  • A (90-99): All critical headers, minor improvements possible
  • B (75-89): Most headers present, some gaps
  • C (60-74): Several missing headers
  • D (40-59): Major security gaps
  • F (<40): Critical headers missing

CI Integration

Exit codes:

  • 0 — Grade A or better
  • 1 — Grade B-C (warnings)
  • 2 — Grade D-F (failures)

Use --min-grade B to set custom threshold:

python3 scripts/scan_headers.py https://example.com --min-grade B

Workflow

  1. User provides URL(s) to scan
  2. Run the scan script
  3. Present the grade and findings
  4. Highlight critical missing headers first
  5. Provide specific fix recommendations (Nginx, Apache, Cloudflare snippets)