security_header

A lightweight bash script that audits the HTTP security headers of one or more domains and writes a human-readable report. It checks for the presence of the most important response headers and performs a deeper analysis on Content-Security-Policy, flagging weak or dangerous patterns.

Disclaimer: Only run this against domains you own or have explicit permission to test.

Features

• Checks the following response headers:
  • Strict-Transport-Security
  • X-Frame-Options
  • X-Content-Type-Options
  • Referrer-Policy
  • Content-Security-Policy
  • Permissions-Policy
• Follows redirects (curl -L) so the final response is what's analyzed.
• Parses Content-Security-Policy and flags weaknesses such as:
  • unsafe-inline, unsafe-eval, unsafe-hashes
  • Wildcard sources (*)
  • Bare scheme sources (https:, http:, data:)
  • Missing script-src / object-src / base-uri / frame-ancestors
  • Missing fallback to a weak default-src
• Color-coded terminal output and a plain-text report file for sharing.
• One domain per line; blanks and # comments are ignored.

Requirements

• bash (v4+ for associative arrays)
• curl

Usage

chmod +x check_headers.sh
./check_headers.sh <domains_file>

<domains_file> is a plain text file with one domain per line. A report file named header_check_report_<timestamp>.txt is written to the current directory.

Example

./check_headers.sh domains.txt

Sample session:

==> Checking: https://example.com
  [FOUND] Strict-Transport-Security: max-age=31536000; includeSubDomains
  [FOUND] X-Frame-Options: DENY
  ...
  [MISSING] Permissions-Policy

Adding domains

Open domains.txt (or any text file you choose to use) and add one domain per line. The script automatically prepends https:// if no scheme is provided.

domains.txt:

testasp.vulnweb.com
example.com
github.com
# this is a comment and will be skipped
https://another-site.org   # scheme is optional

Rules:

• One domain per line.
• Lines starting with # are treated as comments and skipped.
• Empty lines are ignored.
• http:// or https:// may be included explicitly; otherwise https:// is assumed.

Notes

• The script reads only response headers (curl -I -L), so it does not download page bodies.
• For Content-Security-Policy, only the sensitive directives (script-src, object-src, base-uri, frame-ancestors, default-src, style-src, form-action) are analyzed in detail.
• A 10-second timeout is applied per request.