Security Posture Checker

Security Posture Checker is a lightweight Python defensive-security tool that assesses selected web security controls and saves structured results as JSON.

Problem

Small organisations and developers may operate websites without dedicated cybersecurity teams. Basic security weaknesses such as missing HTTP security headers or insecure configurations can therefore go unnoticed.

This project explores whether a lightweight automated system can identify, organise and eventually prioritise common web security configuration weaknesses.

Current Version

v0.1 — Foundation

Current Features

• Accepts a domain or URL
• Automatically adds HTTPS when required
• Validates HTTP and HTTPS URLs
• Sends an HTTP request to the target
• Records the HTTP response status
• Checks:
  • Content-Security-Policy
  • Strict-Transport-Security
  • X-Content-Type-Options
• Flags headers as present or missing
• Saves results as JSON

Installation

Clone the repository:

git clone https://github.com/ekirigwegideon/website-security-checker.git
cd website-security-checker

Create and activate a virtual environment:

python3 -m venv .venv
source .venv/bin/activate

Install dependencies:

pip install -r requirements.txt

Usage

Only test websites that you own or have explicit permission to assess.

python scanner.py https://example.com

A domain can also be supplied without the protocol:

python scanner.py example.com

Example Output

[*] Target: https://cyvack.com
[*] Sending HTTP request...
[+] Response status: 200
[+] Final URL: https://cyvack.com/

Security Header Results
-----------------------
Content-Security-Policy: MISSING
Strict-Transport-Security: PRESENT
X-Content-Type-Options: PRESENT

[+] Result saved to: results/scan_20260814_122509.json

Example JSON Result

{
  "scanner_version": "0.1",
  "target": "https://cyvack.com",
  "status_code": 200,
  "security_headers": {
    "Content-Security-Policy": {
      "status": "missing"
    },
    "Strict-Transport-Security": {
      "status": "present"
    },
    "X-Content-Type-Options": {
      "status": "present"
    }
  }
}

Limitations

Version 0.1:

• Checks only a small number of HTTP security headers
• Does not perform vulnerability exploitation
• Does not scan network ports
• Does not test authentication
• Does not brute-force credentials
• Does not determine whether every present header is securely configured
• Only analyses the HTTP response returned by the target

Development Roadmap

The roadmap represents the planned direction of the project and may change as development and MSc research progress.

v0.1 — Foundation ✅

• URL/domain validation
• HTTP request handling
• Initial security-header checks
• JSON result generation

v0.2 — Web Security Checks

• Expand HTTP security-header checks
• Cookie security attributes
• Redirect and HTTPS behaviour
• Basic information-exposure checks

v0.3 — TLS Assessment

• TLS protocol and version analysis
• Certificate information
• Certificate expiry detection
• Weak or deprecated configuration detection

v0.4 — Risk Engine

• Severity classification
• Finding weighting
• Security-posture score
• Explanation for each score

v0.5 — SME Context & Prioritisation

• Website/business context
• Asset importance
• Exposure assessment
• Prioritised findings
• Actionable remediation guidance

v1.0 — MSc Research Prototype

• Web dashboard
• Complete security assessment report
• Controlled test environments
• Baseline comparison
• Accuracy and evaluation metrics
• Research results

Research Direction

The long-term research goal is to investigate whether a lightweight automated web security posture assessment system can accurately identify and prioritise common security configuration weaknesses for small organisations.

The project aims to progress beyond simply listing technical findings by investigating security scoring, prioritisation and understandable remediation guidance.

Ethical Use

This project is intended for defensive cybersecurity research, education and authorised security assessment.

Only test websites or systems that you own or have explicit permission to assess.