PHPackages                             ctrlwebinc/security-headers-checker - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [HTTP & Networking](/categories/http)
4. /
5. ctrlwebinc/security-headers-checker

ActiveLibrary[HTTP & Networking](/categories/http)

ctrlwebinc/security-headers-checker
===================================

A Laravel package to check HTTP security headers

0.0.3(3mo ago)03MITPHPPHP ^8.5

Since Apr 23Pushed 3mo agoCompare

[ Source](https://github.com/ctrlwebinc/security-headers-checker)[ Packagist](https://packagist.org/packages/ctrlwebinc/security-headers-checker)[ RSS](/packages/ctrlwebinc-security-headers-checker/feed)WikiDiscussions master Synced 2w ago

READMEChangelogDependencies (6)Versions (4)Used By (0)

security-headers-checker
========================

[](#security-headers-checker)

A Laravel 12 package to check HTTP security headers.

Detects missing, misconfigured, and deprecated security headers, exposes an Artisan command and a REST API endpoint, and returns a security score.

---

Requirements
------------

[](#requirements)

- PHP 8.5+
- Laravel 12

---

Installation
------------

[](#installation)

```
composer require ctrlwebinc/security-headers-checker
```

The package auto-discovers itself via Laravel's package auto-discovery. No manual registration needed.

### Publish the config (optional)

[](#publish-the-config-optional)

```
php artisan vendor:publish --tag=security-headers-checker-config
```

This creates `config/security-headers-checker.php` where you can customize headers, timeouts, SSL verification, route prefix, and middleware.

---

Usage
-----

[](#usage)

### Artisan command

[](#artisan-command)

```
# Basic check
php artisan security-headers:check https://example.com

# With all options
php artisan security-headers:check https://example.com \
  --information \
  --caching \
  --deprecated \
  --json

# Custom port
php artisan security-headers:check https://example.com --port=8443

# With cookie and proxy
php artisan security-headers:check https://example.com \
  --cookie="session=abc123" \
  --proxy=http://127.0.0.1:8080

# Custom request header (repeatable)
php artisan security-headers:check https://example.com \
  --add-header="Authorization: Bearer mytoken" \
  --add-header="X-Custom: value"

# Disable SSL verification
php artisan security-headers:check https://self-signed.example.com --disable-ssl

# Use GET instead of HEAD
php artisan security-headers:check https://example.com --use-get
```

#### Available options

[](#available-options)

OptionShortDescription`--port=``-p`Custom port`--cookie=``-c`Cookie string`--add-header=``-a`Extra header (repeatable)`--disable-ssl``-d`Skip SSL/TLS verification`--use-get``-g`GET instead of HEAD`--json``-j`JSON output`--information``-i`Show informational headers`--caching``-x`Show cache headers`--deprecated``-k`Show deprecated headers`--proxy=`Proxy URL---

### REST API

[](#rest-api)

The package registers a single endpoint:

```
POST /api/security-headers-checker/analyze
Content-Type: application/json

```

#### Request body

[](#request-body)

```
{
  "url": "https://example.com",
  "use_get": false,
  "disable_ssl": false,
  "cookies": "session=abc123",
  "headers": { "Authorization": "Bearer token" },
  "proxy": "http://127.0.0.1:8080",
  "show_information": false,
  "show_caching": false,
  "show_deprecated": false
}
```

#### Response

[](#response)

```
{
  "success": true,
  "data": {
    "url": "https://example.com",
    "status_code": 200,
    "score": 75,
    "present": [
      { "header": "Strict-Transport-Security", "value": "max-age=31536000", "flag": null }
    ],
    "missing": [
      { "header": "Content-Security-Policy", "flag": "warning" }
    ],
    "insecure": [
      {
        "header": "X-Frame-Options",
        "value": "ALLOWALL",
        "reason": "Value 'ALLOWALL' is not DENY or SAMEORIGIN."
      }
    ],
    "deprecated": [],
    "information": [],
    "caching": []
  }
}
```

To disable the built-in routes and define your own:

```
// config/security-headers-checker.php
'routes' => [
    'enabled' => false,
],
```

Then in `routes/api.php`:

```
use Ctrlwebinc\SecurityHeadersChecker\Http\Controllers\SecurityHeadersController;

Route::post('/my-path/analyze', [SecurityHeadersController::class, 'analyze']);
```

---

### Facade

[](#facade)

```
use Ctrlwebinc\SecurityHeadersChecker\Facades\SecurityHeadersChecker;

$result = SecurityHeadersChecker::analyze('https://example.com', options: [
    'disable_ssl' => true,
], showInformation: true);

$score = SecurityHeadersChecker::score($result);
```

### Dependency injection

[](#dependency-injection)

```
use Ctrlwebinc\SecurityHeadersChecker\Services\SecurityHeadersService;

class MyController extends Controller
{
    public function __construct(private SecurityHeadersService $checker) {}

    public function check(Request $request): JsonResponse
    {
        $result = $this->checker->analyze($request->input('url'));
        return response()->json(['score' => $this->checker->score($result)]);
    }
}
```

---

Configuration
-------------

[](#configuration)

After publishing, edit `config/security-headers-checker.php`:

```
return [
    'routes' => [
        'enabled'    => true,
        'prefix'     => 'api/security-headers-checker',
        'middleware' => ['api'],
    ],
    'http' => [
        'timeout'    => 15,
        'verify_ssl' => true,
        'use_get'    => false,
    ],
    // Customize which headers are checked and their severity:
    // null = critical, 'warning' = best practice, 'deprecated' = should be removed
    'security_headers' => [
        'Strict-Transport-Security' => null,
        'Content-Security-Policy'   => 'warning',
        'Expect-CT'                 => 'deprecated',
        // ...
    ],
];
```

Environment variables:

```
SECURITY_HEADERS_CHECKER_ROUTES_ENABLED=true
SECURITY_HEADERS_CHECKER_ROUTE_PREFIX=api/security-headers-checker
SECURITY_HEADERS_CHECKER_TIMEOUT=15
SECURITY_HEADERS_CHECKER_VERIFY_SSL=true
```

---

Security score
--------------

[](#security-score)

The score (0–100) is calculated as:

```
score = (present_critical_headers / total_critical_headers) × 100 − (insecure_count × 10)

```

ScoreRating70–100✅ Good40–69⚠️ Needs improvement0–39❌ Insufficient---

Headers checked
---------------

[](#headers-checked)

### Critical (absence = failure)

[](#critical-absence--failure)

- `Strict-Transport-Security`
- `X-Frame-Options`
- `X-Content-Type-Options`
- `X-XSS-Protection`

### Warning (absence = best-practice warning)

[](#warning-absence--best-practice-warning)

- `Content-Security-Policy`
- `Referrer-Policy`
- `Permissions-Policy`
- `Cross-Origin-Embedder-Policy`
- `Cross-Origin-Resource-Policy`
- `Cross-Origin-Opener-Policy`

### Deprecated (presence = warning)

[](#deprecated-presence--warning)

- `X-Permitted-Cross-Domain-Policies`
- `Expect-CT`

### Informational (shown with `--information`)

[](#informational-shown-with---information)

- `Server`, `X-Powered-By`, `X-AspNet-Version`, `X-AspNetMvc-Version`

### Cache (shown with `--caching`)

[](#cache-shown-with---caching)

- `Cache-Control`, `Pragma`, `Last-Modified`, `Expires`, `ETag`

---

Testing
-------

[](#testing)

```
composer install
./vendor/bin/phpunit
```

---

License
-------

[](#license)

MIT

Author
------

[](#author)

Daniel Le Blanc —  — [ctrlweb.ca](https://ctrlweb.ca)

###  Health Score

35

—

LowBetter than 77% of packages

Maintenance82

Actively maintained with recent releases

Popularity3

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity43

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~0 days

Total

3

Last Release

92d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/31c6838722e93fa1f32630287da5e8f3845567a6cf4050240f98d4d4de170e50?d=identicon)[ctrlwebinc](/maintainers/ctrlwebinc)

---

Top Contributors

[![danidou](https://avatars.githubusercontent.com/u/193566?v=4)](https://github.com/danidou "danidou (3 commits)")

---

Tags

httplaravelsecurityheaderssecurity-headers

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/ctrlwebinc-security-headers-checker/health.svg)

```
[![Health](https://phpackages.com/badges/ctrlwebinc-security-headers-checker/health.svg)](https://phpackages.com/packages/ctrlwebinc-security-headers-checker)
```

###  Alternatives

[laravel/mcp

Rapidly build MCP servers for your Laravel applications.

77922.3M186](/packages/laravel-mcp)[psalm/plugin-laravel

Psalm plugin for Laravel

3345.3M347](/packages/psalm-plugin-laravel)[laravel/cashier

Laravel Cashier provides an expressive, fluent interface to Stripe's subscription billing services.

2.5k30.2M151](/packages/laravel-cashier)[laravel/pulse

Laravel Pulse is a real-time application performance monitoring tool and dashboard for your Laravel application.

1.7k15.1M136](/packages/laravel-pulse)[api-platform/laravel

API Platform support for Laravel

58174.6k17](/packages/api-platform-laravel)[roots/acorn

Framework for Roots WordPress projects built with Laravel components.

9762.4M133](/packages/roots-acorn)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)