header-check

Audit HTTP security headers on any URL. Checks CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Gives you a letter grade A-F and generates fix snippets for Express and Nginx.

Install

npm install -g @lxgicstudios/header-check

Or run directly with npx:

npx @lxgicstudios/header-check https://example.com

Usage

# Basic security audit
header-check https://example.com

# Audit with fix suggestions for Express and Nginx
header-check https://example.com --fix

# CI mode - fail if grade is below B
header-check https://example.com --ci --min-grade B

# JSON output
header-check https://example.com --json

Features

• Checks 7 critical security headers with weighted scoring
• Letter grade A-F based on overall security posture
• Generates ready-to-use config snippets for Express.js and Nginx
• CI-friendly with --ci and --min-grade flags
• JSON output for automation
• ZERO external dependencies
• Works with HTTP and HTTPS URLs

Headers Checked

| Header | Points | What It Does | |--------|--------|-------------| | Content-Security-Policy | 10 | Prevents XSS and injection attacks | | Strict-Transport-Security | 10 | Forces HTTPS connections | | X-Frame-Options | 5 | Prevents clickjacking | | X-Content-Type-Options | 5 | Prevents MIME type sniffing | | Referrer-Policy | 5 | Controls referrer information | | Permissions-Policy | 5 | Controls browser features (camera, mic, etc.) | | X-XSS-Protection | 5 | Legacy XSS filter hint |

Options

| Option | Description | |--------|-------------| | --fix | Show config snippets for Express and Nginx | | --ci | CI mode (exit code 1 if below min-grade) | | --min-grade <A-F> | Minimum acceptable grade (default: C) | | --json | Output results as JSON | | --help | Show help message |

Grading Scale

| Grade | Score | |-------|-------| | A | 90-100% | | B | 80-89% | | C | 65-79% | | D | 50-64% | | F | Below 50% |

CI Usage

# Fail the build if security headers aren't up to par
npx @lxgicstudios/header-check https://your-site.com --ci --min-grade B

License

MIT - LXGIC Studios