security_header

A lightweight bash script that audits the HTTP security headers of one or more domains and writes a human-readable report. It checks for the presence of the most important response headers and performs a deeper analysis on Content-Security-Policy, flagging weak or dangerous patterns.

Disclaimer: Only run this against domains you own or have explicit permission to test.

Features

• Checks the following response headers:
  • Strict-Transport-Security
  • X-Frame-Options
  • X-Content-Type-Options
  • Referrer-Policy
  • Content-Security-Policy
  • Permissions-Policy
• Follows redirects (curl -L) so the final response is what's analyzed.
• Parses Content-Security-Policy and flags weaknesses such as:
  • unsafe-inline, unsafe-eval, unsafe-hashes
  • Wildcard sources (*)
  • Bare scheme sources (https:, http:, data:)
  • Missing script-src / object-src / base-uri / frame-ancestors
  • Missing fallback to a weak default-src
• Color-coded terminal output and a plain-text report file for sharing.
• One domain per line; blanks and # comments are ignored.
• Prints a run summary after the scan (see below).

Scan summary

After every domain is checked, the report ends with a summary block:

=========================================
                     SCAN SUMMARY
=========================================
  Domains scanned          : 4
  Domains failed to scan   : 1
      - http://127.0.0.1:9999 (curl exit 7)

  Security headers found   : 13
  Security headers missing : 5

  Per-header breakdown:
    FOUND  MISS   HEADER
    2      1      Strict-Transport-Security
    2      1      X-Frame-Options
    3      0      X-Content-Type-Options
    2      1      Referrer-Policy
    2      1      Content-Security-Policy
    2      1      Permissions-Policy

  Weak CSP found           : 1  (one CSP counts once, no matter how many issues)
=========================================

Counting rules:

• Domains scanned — every non-blank, non-comment line in the input file, including ones that then fail to connect.
• Domains failed to scan — the failed subset, each listed with its curl exit code.
• Headers found / missing — individual checks across all domains. With 3 reachable domains and 6 headers checked, the denominator is 18. The per-header table breaks the same totals down by header, so you can see which header is most often absent.
• Weak CSP found — counts each Content-Security-Policy header that exists and fails analysis, as one, no matter how many weak patterns the analysis flagged inside it. A CSP with 11 issues still counts as 1. A domain with no CSP at all does not count here; it is counted once under headers missing instead, so "absent" and "present but weak" stay separate.

Requirements

• bash (v4+ for associative arrays)
• curl

Usage

chmod +x check_headers.sh
./check_headers.sh <domains_file>

<domains_file> is a plain text file with one domain per line. A report file named header_check_report_<timestamp>.txt is written to the current directory.

Example

./check_headers.sh domains.txt

Sample session:

==> Checking: https://example.com
  [FOUND] Strict-Transport-Security: max-age=31536000; includeSubDomains
  [FOUND] X-Frame-Options: DENY
  ...
  [MISSING] Permissions-Policy

=========================================
                     SCAN SUMMARY
=========================================
...

Adding domains

Open domains.txt (or any text file you choose to use) and add one domain per line. The script automatically prepends https:// if no scheme is provided.

domains.txt:

testasp.vulnweb.com
example.com
github.com
# this is a comment and will be skipped
https://another-site.org   # scheme is optional

Rules:

• One domain per line.
• Lines starting with # are treated as comments and skipped.
• Empty lines are ignored.
• http:// or https:// may be included explicitly; otherwise https:// is assumed.

Notes

• The script reads only response headers (curl -I -L), so it does not download page bodies.
• For Content-Security-Policy, only the sensitive directives (script-src, object-src, base-uri, frame-ancestors, default-src, style-src, form-action) are analyzed in detail.
• A 10-second timeout is applied per request.