timofurrer / securityheaders Goto Github PK

https://securityheaders.com/?q=affili.net has a helpful line at the top of the report for redirects allowing one-click following of the redirect to get the report on the redirect target.

It would be as useful on the CLI to have a "follow redirects" arg, with the report emitted for each step of the redirect path.

Cyclic redirect detection would be needed.

When scanning a http site, or without giving a protocol in the CLI args, the output contains "(Scan again over https)" which is a link in the web interface https://securityheaders.com/ , so IMO should be removed from the CLI output or transformed into a note about how to invoke for https.

And it might be appropriate to simply do http followed by https in the CLI if no scheme was provided in the CLI args.

https://hstspreload.org/ provides some useful checks not provided by https://securityheaders.com/

Would you be interested in this CLI tools scope being expanded slightly to include fetching the results from hstspreload.org ?