360 Secure SkillHub
360 安全技能中心

Http Sec Audit

通过 Python 脚本请求目标网站，检查 HSTS、CSP、X-Frame-Options 等 10 个安全响应头，按严重性评分并给出 A–F 等级与修复建议，同时检测 Server、X-Powered-By 等信息泄露；支持多 URL 和 JSON 输出，依赖 requests。

johnnywang2001
johnnywang2001
热度 81.12
最近更新 2026-05-11 17:30:32
分类：安全依赖：代码执行 / 第三方 API应用场景：DevOps / 报告撰写

安装技能

复制下面的话术发给你的 Agent，它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill： npx secure-skills-cli add http-sec-audit
Metadata
name
http-sec-audit
description
Audit HTTP security headers for any website. Use when a user asks to check security headers, harden a web server, audit HSTS/CSP/X-Frame-Options compliance, find information leaks (Server, X-Powered-By), or assess a website's security posture. Checks 10 security headers and grades A–F. Supports multiple URLs and JSON output.

HTTP Security Headers Audit

Scan any URL for missing or misconfigured security headers and get an actionable report with grades, fix recommendations, and info-leak detection.

Quick Start

python3 scripts/sec_headers.py https://example.com

Commands

# Single URL audit
python3 scripts/sec_headers.py https://example.com

# Multiple URLs
python3 scripts/sec_headers.py https://example.com https://google.com https://github.com

# JSON output (for programmatic use)
python3 scripts/sec_headers.py https://example.com --json

# Custom timeout
python3 scripts/sec_headers.py https://example.com --timeout 5

What It Checks

Security headers (graded by severity):

  • Strict-Transport-Security (HSTS) — HIGH
  • Content-Security-Policy (CSP) — HIGH
  • X-Content-Type-Options — MEDIUM
  • X-Frame-Options — MEDIUM
  • Referrer-Policy — MEDIUM
  • Permissions-Policy — MEDIUM
  • X-XSS-Protection — LOW
  • Cross-Origin-Opener-Policy (COOP) — LOW
  • Cross-Origin-Resource-Policy (CORP) — LOW
  • Cross-Origin-Embedder-Policy (COEP) — LOW

Info leak detection:

  • Server header (software version disclosure)
  • X-Powered-By (technology stack leak)
  • X-AspNet-Version (framework version leak)

Grading

Grade Score Meaning
A 90–100 Excellent — all critical headers present
B 75–89 Good — minor gaps
C 50–74 Fair — important headers missing
D 25–49 Poor — significant exposure
F 0–24 Failing — most headers absent

Dependencies

pip install requests