A comprehensive security auditing tool that analyzes HTTP response headers to assign letter grades and provide actionable remediation steps.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install http-security-headers
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install http-security-headers using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is HTTP Security Headers Analyzer?
The HTTP Security Headers Analyzer is a robust security auditing utility designed to evaluate the defensive posture of any web application. By examining 15 distinct security headers, this tool identifies vulnerabilities such as XSS risks, clickjacking, and information leakage, providing developers with a clear A-F grade based on industry best practices.
Built to integrate seamlessly into modern developer workflows, this component of Openclaw Skills helps ensure that production environments are hardened against common attack vectors. It goes beyond simple detection by offering specific configuration snippets for Nginx, Apache, and Cloudflare, making it an essential asset for security-conscious engineers.
HTTP Security Headers Analyzer Use Cases
- Performing instant security audits on production URLs to check for missing HSTS or CSP headers.
- Running batch scans across multiple microservices to ensure consistent security compliance.
- Integrating security gatekeeping into CI/CD pipelines to fail builds if a website security grade drops below a specific threshold.
- Identifying tech-stack disclosures in response headers that could lead to targeted exploits.
How HTTP Security Headers Analyzer Works
- The user provides one or more target URLs for analysis through the Openclaw Skills interface.
- The system executes a specialized scanning script that fetches the HTTP response headers from the target server.
- The analyzer evaluates the presence and configuration of 15 security headers against an OWASP-aligned scoring matrix.
- Negative indicators, such as server version disclosure in the 'X-Powered-By' header, are identified to penalize the final score.
- A comprehensive report is generated, providing a letter grade (A+ through F) and prioritized fix recommendations.
HTTP Security Headers Analyzer Setup
To begin using this tool within your environment, ensure you have Python 3 installed. You can run a single scan or batch process URLs using the following commands:
# Install dependencies (if applicable) and scan a single URL
python3 scripts/scan_headers.py https://your-website.com
# Run a batch scan for multiple endpoints
python3 scripts/scan_headers.py https://site-a.com https://site-b.com
# Generate a Markdown report for documentation
python3 scripts/scan_headers.py https://example.com --format markdown
HTTP Security Headers Analyzer Data Schema & Taxonomy
The analyzer organizes its findings into a structured report focusing on impact and remediation. The data is categorized as follows:
| Data Point | Description |
|---|---|
| Security Grade | An A-F score calculated based on a 100-point scale. |
| Header Analysis | Detailed status of 15 headers including CSP, HSTS, and X-Frame-Options. |
| Negative Indicators | Identification of sensitive info leakage (e.g., Server, X-Powered-By). |
| Remediation | Technical snippets for Nginx, Apache, and Cloudflare. |
| Exit Codes | Status codes (0, 1, 2) mapped to grade thresholds for automation. |
HTTP Security Headers Analyzer Advanced Features
- Multi-format output support including JSON for programmatic consumption and Markdown for documentation.
- Customizable CI/CD thresholds using the
--min-gradeflag to enforce strict security standards in deployment pipelines. - Comprehensive coverage of cross-origin policies (COOP, CORP, COEP) for modern browser-based security isolation.
- Automated detection of legacy or deprecated headers to keep security configurations modern and efficient.
SKILL.md
Loading
Related Openclaw Skills
JSONPath Query
An advanced command-line tool for navigating, filtering, and extracting data from JSON structures using complex JSONPath expressions.
Terraform Module Linter
An automated linting tool for Terraform that enforces 24 rules across structure, naming, security, and best practices categories.
SWC Config Validator
A comprehensive auditing tool to validate SWC configuration files for syntax errors, transform conflicts, and transpilation best practices.
Dependency Health Check
A multi-ecosystem audit tool to identify outdated, vulnerable, and unused packages while ensuring license compliance.
Makefile Linter
A lightweight, dependency-free Python linter for validating Makefile syntax, portability, and best practices.
Biome Config Validator
A specialized utility to audit and validate biome.json configuration files for errors, conflicts, and deprecated settings.
Featured*
