Boost site security checks with a CLI instead of manual URL pasting

Security header audits shouldn’t require switching tabs or pasting URLs into web forms. A new command-line tool transforms compliance checks from a manual chore into an automated workflow that runs in your terminal, CI pipeline, or unit tests. Instead of navigating to securityheaders.com and eyeballing reports, developers can now fetch a site’s HTTP security grade in seconds—without ever leaving their editor.

By replacing clipboard operations with a single command, the tool eliminates the risk of unnoticed regressions slipping into production. A forgotten Content-Security-Policy header or misconfigured HSTS directive can remain undetected for weeks when audits depend on manual processes. Automating the check ensures visibility and accountability at every stage of the deployment cycle.

Run security scans directly from the terminal

The tool ships as an npm package that can be executed via npx without permanent installation. A simple command fetches a site’s security headers, evaluates them against seven standardized categories, and returns a color-coded grade in the terminal. For teams that rely on continuous integration, the same command can block deployments when the grade falls below a defined threshold.

npx @hailbytes/security-headers 

For scenarios that require programmatic integration—such as automated testing or middleware validation—the package exposes a JavaScript API. Developers can import the analyzer directly into their codebase to evaluate headers before they’re sent to the client, ensuring consistent enforcement across all routes.

import { analyze } from '@hailbytes/security-headers';

const report = await analyze(');
console.log(report.grade); // Outputs: A+

For unit tests or pre-deployment validations, the library can also ingest raw header objects, bypassing network requests entirely. This capability is particularly useful for verifying security policies in isolated environments or testing middleware that modifies headers dynamically.

import { analyzeHeaders } from '@hailbytes/security-headers';

const report = analyzeHeaders({
  'strict-transport-security': 'max-age=31536000; includeSubDomains',
  'content-security-policy': "default-src 'self'",
  'x-frame-options': 'DENY'
});

Seven security categories evaluated automatically

The analyzer evaluates each site against seven critical security headers, assigning numeric scores and descriptive statuses for each. Missing headers, misconfigurations, and suboptimal values are flagged with actionable remediation steps that can be pasted directly into tickets or documentation.

• HSTS (Strict-Transport-Security): Enforces HTTPS and prevents downgrade attacks by specifying minimum durations and subdomain inclusion.
• CSP (Content-Security-Policy): Restricts resource origins to mitigate cross-site scripting and data injection risks.
• X-Frame-Options: Blocks clickjacking by preventing page rendering inside iframes.
• X-Content-Type-Options: Disables MIME-sniffing to reduce drive-by download threats.
• Referrer-Policy: Controls referrer header leakage across navigation events.
• Permissions-Policy: Restricts browser features like geolocation or camera access to authorized origins only.
• Cross-Origin Policies (COEP/COOP/CORP): Manages cross-origin isolation for secure credential handling and resource sharing.

Each category is scored individually, and the cumulative result determines the overall grade. Missing headers receive a zero score, while subpar configurations trigger warnings with concrete next steps.

Grade thresholds and CI integration

The grading scale follows a straightforward percentile model, with clear benchmarks for each letter grade. Scores above 90% earn an A+, while grades below 20% result in an F. These thresholds provide immediate visibility into security posture and help teams prioritize fixes based on risk levels.

• A+ ≥ 90%
• A ≥ 75%
• B ≥ 60%
• C ≥ 40%
• D ≥ 20%
• F < 20%

For teams practicing continuous delivery, the CLI can serve as a gatekeeper during deployment. By integrating the command into CI pipelines and configuring it to fail builds on regressions, organizations can enforce security standards before updates reach end users. The non-zero exit code simplifies integration with most CI systems, eliminating the need for custom scripting.

npx @hailbytes/security-headers  || exit 1

With automation handling the routine checks, teams can shift focus from manual audits to proactive improvements. The tool’s open-source license and lightweight design make it ideal for adoption across projects of any scale, reducing the cognitive overhead of maintaining secure configurations.

Looking ahead, security tooling will continue to evolve toward tighter integration with development workflows. As browsers enforce stricter defaults and compliance requirements grow more stringent, automating these checks early in the pipeline will become less of an option and more of a necessity.