HeaderGrade - Security header auditor

HeaderGrade

A free, self-hosted web security auditor that scans any public URL and grades it A+ to F.

Paste a domain and HeaderGrade inspects its entire security posture in one pass — response headers, TLS certificate, cookie configuration, redirect chain and threat-intelligence reputation — then collapses everything into a single weighted score with a letter grade. Every finding is explained in plain language with a concrete fix, not just flagged.

What it checks

Response headers (60 points) — Content-Security-Policy (18), Strict-Transport-Security (12), X-Frame-Options (6), X-Content-Type-Options (5), Referrer-Policy (5), Permissions-Policy (5), Cross-Origin-Opener-Policy (5), Cross-Origin-Resource-Policy (4). CSP is parsed and analysed heuristically rather than merely detected, so a policy that exists but is wide open still scores badly.

Transport (40 points) — a real certificate inspection over node:tls (issuer, validity window, SANs, protocol version, days remaining), HTTPS enforcement, downgrade detection, and cookie correctness.

Checks that don't apply are dropped from both sides of the ratio, so an HTTP-only site is graded fairly instead of being handed twelve free HSTS points.

Six result tabs

Headers — every check with pass/warn/fail, its weight, why it matters and how to fix it. TLS — full certificate chain detail. Cookies — flags analysed individually (Secure, HttpOnly, SameSite). Redirects — the full hop-by-hop chain, which is where malware bounces hide. Reputation — URLhaus and OpenPhish feed matching, checked against both the submitted URL and its post-redirect destination. Raw — the untouched response headers.

Threat intelligence

Matching runs on free bulk feeds (URLhaus recent activity, OpenPhish), cached in memory — no API keys, no paid services. Three tiers prevent false positives on shared platforms: an exact URL match reports listed, a host-only match reports host listed in amber, and host-level verdicts are suppressed entirely on ~35 shared domains like github.com and vercel.app where a single bad URL would otherwise condemn an entire platform.

Grades

A+ 95–100 · A 90–94 · B 80–89 · C 70–79 · D 55–69 · F below 55

Built to be deployed

No build step, no bundler, no database, no Docker. Express plus a single HTML file on the Tailwind CDN — clone, npm install, npm start.

- SSRF-hardened. Private, loopback, link-local and cloud-metadata ranges are refused, including octal (0177.0.0.1), decimal (2130706433) and IPv6 ([fdff::1]) obfuscation. Redirects are followed manually with per-hop revalidation so a public URL cannot bounce into the private network.

- Rate limiting that can't be defeated by forging X-Forwarded-For (trust proxy is opt-in via TRUST_PROXY=1).

- No XSS. Every remote-controlled string — certificate fields, cookie names, redirect URLs, feed labels, scan history — reaches the DOM through textContent and DOM APIs, never innerHTML.

- Accessible. Tabs implement the WAI-ARIA pattern with roving tabindex and arrow/Home/End navigation; prefers-reduced-motion honoured.

- Three themes — light, dark and hacker (black + lime) — persisted to localStorage, with Shift+T to cycle.

Also included

Batch scanning of multiple URLs, JSON export, a copyable Markdown report, scan history, plus /.well-known/security.txt discovery and IPv6 availability probes.

Honest limitations

Sites with invalid certificates can't be scanned, because Node's fetch refuses the handshake. URLhaus's recent-activity feed means "not listed" is weaker than a VirusTotal verdict. There's no cipher-suite grading, and no DNS-rebinding pinning. Rate limits are per-instance and in memory.

188 assertions across 23 groups, fully offline — node test.js.