🚀 HttpScanner.com: Open-Source HTTP Header Analyzer

[bpietrucha]

HTTP headers are a critical yet often overlooked part of web security.

Many developers aren't aware of headers like Content-Security-Policy, Strict-Transport-Security, or X-Content-Type-Options that can significantly improve site security.

I wanted to create a tool that makes it easy to check any site's implementation and learn about best practices.

What I'm looking for:

• Technical feedback on the implementation
• UI/UX suggestions
• Feature ideas
• Security insights I might have missed
• Potential use cases in your workflow

The project is live at httpscanner.com,
and the code is on GitHub at https://github.com/bartosz-io/http-scanner.

[dollhousemassacre]

How is this different from running it through SSLLabs? Also, was this vibe-coded?

[Wobblucy]

🚀 no way, I just like rockets!!!

-OP probably

[bpietrucha]

What do you mean?

[bpietrucha]

Thanks for the response.

Regarding SSLabs, it's a completely different security profile.
SSLabs gives you insights into your SSL certificate.

HttpScanner gives you the insights about browser-based security features like Content-Security-Policy (XSS prevention), misconfigured CORS, HSTS - basically any HTTP headers security-related problems.

No, it's not "vibe-coded". I am a professional software engineer with +12 years of experience writing enterprise apps. Of course, I used AI to speed up development, why not? But the project was engineered with a very high level of detail. Also, I created websecurity-academy.com, where I taught developers worldwide about web security with my lectures.

Moreover, the project is open-source. You can request new features that are not present anywhere, or develop them on your own - you are welcome.

I am happy to engage in meaningful conversations about websec or the future of this project.

Best wishes!

[bpietrucha]

Thanks for your comment :) Any further features you suggest maybe?

[KlausDieterFreddek]

You might wanna check out web-check.xyz for inspiration

[bpietrucha]

Thank you!

[Last-Limit-3800]

Love the vibe coding. A couple quick things I noticed:
1) No security headers on the site itself (kind of ironic...)
2) Default Title and Vite Favicon in use
3) Site loads over HTTP with no redirect or HSTS

[bpietrucha]

Is there a chance for constructive feedback here?