Securityheaders.io – Analyse your HTTP response headers

Re:Securityheaders.io – Analyse your HTTP response headers by russum on Thursday February 11, 2016 @08:34AM (#11079977)

What other/similar analyzers are out there?

[ Parent | on HN ]

Re:Securityheaders.io – Analyse your HTTP response headers by stefanorri on Thursday February 11, 2016 @10:38AM (#11080709)

HTTPSecurityReport - https://httpsecurityreport.com - Disclaimer: I'm the creator.

Site Scan from MS - https://dev.windows.com/en-us/microsoft-edge/tools/staticsca...

Subresource Integrity scanner - https://sritest.io/

[ Parent | on HN ]

Re:Securityheaders.io – Analyse your HTTP response headers by newman314 on Thursday February 11, 2016 @06:26PM (#11084155)

Maybe you can add HTTP2/SPDY detection too. BTW your HSTS test does not verify if the format/syntax is correct.

These are all good but I would include the following:

Qualys SSL Server Test - The first site I use.

testssl.sh - for behind the fireware testing

https://tls.imirhil.fr/ - this one is nice because it shows the ciphers used/avail broken down by TLS version. I have not seen any other site do this.

[ Parent | on HN ]

Re:Securityheaders.io – Analyse your HTTP response headers by Beowolve on Thursday February 11, 2016 @11:02AM (#11080896)

Thanks for these! I like that yours covered a lot more than the one OP posted.

[ Parent | on HN ]

Re:Securityheaders.io – Analyse your HTTP response headers by stefanorri on Thursday February 11, 2016 @11:14AM (#11081009)

Thanks, glad to hear it!

[ Parent | on HN ]

Re:Securityheaders.io – Analyse your HTTP response headers by mwpmaybe on Thursday February 11, 2016 @04:01PM (#11083212)

HTTPSecurityReport is great! Thank you!

[ Parent | on HN ]

Re:Securityheaders.io – Analyse your HTTP response headers by mattvot on Thursday February 11, 2016 @08:42AM (#11080020)

For SSL from Qualys, Inc https://www.ssllabs.com/ssltest/

[ Parent | on HN ]

Re:Securityheaders.io – Analyse your HTTP response headers by tanthony01 on Thursday February 11, 2016 @10:58AM (#11080858)

Last I checked, Qualys only scanned port 443. I like testssl.sh - you can point it at arbitrary ports:

https://testssl.sh/ https://github.com/drwetter/testssl.sh

[ Parent | on HN ]

Re:Securityheaders.io – Analyse your HTTP response headers by stefanorri on Thursday February 11, 2016 @11:14AM (#11081005)

testssl.sh is also great for testing internal servers which aren't internet accessible.

[ Parent | on HN ]

Re:Securityheaders.io – Analyse your HTTP response headers by finnn on Thursday February 11, 2016 @02:39PM (#11082580)

https://ssl-tools.net/ is nice because it will continously retest and email you if there's a problem. Also does mail servers

[ Parent | on HN ]

Re:Securityheaders.io – Analyse your HTTP response headers by cmcnally on Thursday February 11, 2016 @09:19AM (#11080232)

https://mxtoolbox.com/ can give some decent information when setting up a mail server.

[ Parent | on HN ]

Re:Securityheaders.io – Analyse your HTTP response headers by Scott_Helme_ on Thursday February 11, 2016 @09:01AM (#11080117)

There's also https://starttls.info/ which will check mail server configurations.

[ Parent | on HN ]

Re:Securityheaders.io – Analyse your HTTP response headers by mwpmaybe on Monday February 15, 2016 @01:05PM (#11104850)

Huh, comes up with a cert warning. Looks like it's expired.

[ Parent | on HN ]