headers-check

Audit a URL's HTTP security headers and get a letter grade. Checks HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and flags information-disclosure headers. Zero dependencies.

Like securityheaders.com — but it runs locally and never sends your URL to a third-party service.

Install

npm install -g headers-check

Or without installing:

npx headers-check https://example.com

Usage

headers-check https://example.com
headers-check example.com               # https:// assumed
headers-check https://mysite.com --raw  # also dump all headers
headers-check https://mysite.com --strict   # exit 1 unless grade A+
headers-check https://api.example.com --json

Example Output

headers-check  https://example.com  (HTTP 200)

  Grade  A  (88/100)

  ✓ Strict-Transport-Security   max-age=63072000, includeSubDomains
  ✓ Content-Security-Policy     7 directive(s)
  ✓ X-Content-Type-Options      nosniff
  ✓ X-Frame-Options             DENY
  ! Referrer-Policy             weak policy: origin-when-cross-origin
  ✗ Permissions-Policy          missing — browser features not restricted (optional)

  Information disclosure
    • server: nginx/1.21.0  — reveals server software/version
    • x-powered-by: Express  — reveals framework (e.g. Express/PHP)

What's Checked

| Header | Weight | Why it matters | |---|---|---| | Content-Security-Policy | 25 | Primary defense against XSS / injection | | Strict-Transport-Security | 20 | Forces HTTPS, prevents downgrade attacks | | X-Frame-Options | 15 | Stops clickjacking (or CSP frame-ancestors) | | X-Content-Type-Options | 10 | Stops MIME-sniffing attacks | | Referrer-Policy | 10 | Prevents URL leakage to other sites | | Permissions-Policy | 10 | Restricts powerful browser features |

Plus information-disclosure headers (Server, X-Powered-By, X-AspNet-Version, …) which should ideally be removed.

Grading

| Grade | Score | |---|---| | A+ | 95–100 | | A | 85–94 | | B | 70–84 | | C | 55–69 | | D | 40–54 | | E | 20–39 | | F | 0–19 |

CI Integration

- name: Security headers gate
  run: npx headers-check https://staging.myapp.com --strict

Exit codes:

• 0 — reachable (and grade ≥ A with --strict)
• 1 — grade below A (only with --strict)
• 2 — URL unreachable

License

MIT

Keywords

security headers · http headers · content security policy · csp · hsts · securityheaders alternative · x-frame-options · header audit · zero dependencies · security

Built to solve, shared to help — Rushabh Shah 🛠️✨

One of 40+ zero-dependency developer CLI tools — no node_modules, ever.