http-419 🔍

419 = anti-fraud energy. Scan first, ship safer.

http-419 is a zero-dependency HTTP security header scanner for developers.

npx http-419 https://example.com

It checks common security headers, scores the site, and prints what to fix next.

Features

• 10 security checks with weighted scoring (0-100)
• Grade output from A+ to F
• Colorized terminal report with ✅/⚠️/❌
• Recommendations section with actionable fixes
• Zero runtime dependencies (Node built-ins only)

Usage

# scan target URL
npx http-419 https://example.com

# help
npx http-419 -h

# version
npx http-419 -v

Security Checks

| Check | Weight | |------|--------| | HTTPS | 15 | | Strict-Transport-Security (HSTS) | 15 | | Content-Security-Policy (CSP) | 15 | | X-Frame-Options | 10 | | X-Content-Type-Options | 10 | | Referrer-Policy | 10 | | Permissions-Policy | 10 | | X-XSS-Protection | 5 | | Server header exposure | 5 | | X-Powered-By exposure | 5 |

Scoring model:

• Pass = full weight
• Warn = half weight
• Fail = zero

Development

npm install
npm run build
npm test

Why 419?

HTTP 418 belongs to teapots. HTTP 419 belongs to anti-fraud vibes and practical security checks.

License

MIT © Zhang Xilin