✔ Online scanner with best practices for Security Headers

[bartosz-io]

Hi!

My name is Bartosz and I created online training for web developers - websecurity-academy.com.
I bought the domain httpScanner.com and had been working on a free online scanner that will help developers evaluate the HTTP security profile of web applications.

The general idea is to put into a nice UI/UX all the best practices and educate developers for free with guides/tutorials regarding HTTP security headers.

The main screen is just a simple input text and a submit button that redirects to a report page.
Here is a screen of a report prototype:

I wanted to ask you about the feedback - do you think this free resource is worth creating?

Thank you!

[bartosz-io]

Here is why I pinged you on LinkedIn @righettod :)

[righettod]

Hi @bartosz-io

😉 Thanks a lot for opening this discussion thread.

🥇 Very nice project and initiative: websecurity-academy + httpScanner .

❤ For me, every resources that can helps DEV and OPS team to leverage the HTTP security headers is useful.

💡 For httpScanner, a suggestion can be to differ from https://securityheaders.com/ by focusing on providing a better output/feedback that an DEV/OPS can directly leverage.

👀 Some examples:

• If you detect than some headers are missing AND you identify that the remote web server is an Nginx then you can provide the code snippet of the configuration to add the missing headers.
• Same idea regarding headers disclosing technical informations.

📡 To help you, we provided such references JSON file:

✅ So for me, YES your projects are 100% useful.

🥰 Once ready, we will add it to the Technical Resources tab and notify the community about this new tool.

@riramar What is your point of view ?

[bartosz-io]

@righettod Thank you for your feedback! This is awesome ♥️

We are starting the development next week!

[righettod]

You're welcome 😀

[bartosz-io]

Also, I really appreciate the suggestions like:

focusing on providing a better output/feedback that an DEV/OPS can directly leverage.

If you have any additional points here - please share. Thank you! 🦾

[riramar]

@righettod I agree with you. I don't have much to add.

[righettod]

✅ Consider as completed due to past time without interactions.