http-header-cli

Inspect HTTP response headers from the terminal. Includes security header grading (A-F).

Installation

npm install -g http-header-cli

Or run directly:

npx http-header-cli <url>

Usage

http-header-cli [options] <urls...>

Options

| Flag | Description | |------|-------------| | -f, --follow | Follow redirects and show the redirect chain | | -s, --security | Analyze and grade security headers (A+ to F) | | -j, --json | Output results as JSON | | -H, --header <header> | Add a custom request header (repeatable) | | -V, --version | Show version | | -h, --help | Show help |

Examples

Basic header inspection

http-header-cli https://example.com

Security grading

http-header-cli --security https://example.com

Outputs an A-F grade based on:

• Strict-Transport-Security (HSTS)
• Content-Security-Policy (CSP)
• X-Frame-Options
• X-Content-Type-Options
• Referrer-Policy
• Permissions-Policy
• Cross-Origin-Opener-Policy
• Cross-Origin-Resource-Policy
• X-XSS-Protection

Follow redirects

http-header-cli --follow https://example.com

Displays the full redirect chain with intermediate status codes.

Multiple URLs

http-header-cli --security https://example.com https://github.com

Custom request headers

http-header-cli -H "Authorization: Bearer token123" -H "X-Custom: value" https://api.example.com

JSON output

http-header-cli --json --security https://example.com | jq .

JSON output includes all headers and, when --security is used, the full analysis with per-header scores.

Combine flags

http-header-cli --follow --security --json https://example.com

Security Grade Scale

| Score | Grade | |-------|-------| | 90-100% | A+ | | 80-89% | A | | 70-79% | B | | 60-69% | C | | 40-59% | D | | 0-39% | F |

Each security header is weighted by its impact. Missing critical headers (HSTS, CSP) reduce the grade significantly.

License

MIT