A modern website security analyzer that evaluates common web security practices, HTTP security headers, HTTPS configuration, cookies, redirects, and server exposure to provide an easy-to-understand security score with actionable recommendations.
Built with Next.js, TypeScript, and Tailwind CSS.
HardenHQ is deployed at:
The optional FastAPI backend is deployed separately through render.yaml.
- 🔒 HTTPS Detection
- 🛡️ Security Header Analysis
- 📊 Security Score & Grade
⚠️ Vulnerability Summary- 💡 Actionable Security Recommendations
- 🍪 Cookie Security Analysis
- 🔀 Redirect Chain Analysis
- 📄 Raw HTTP Header Viewer
- ⚡ Fast Website Scanning
- 📱 Responsive User Interface
The production scanner includes:
- SSRF protection for private, loopback, metadata, reserved, and internal network targets
- Redirect-by-redirect target validation
- Process-level DNS egress protection for server-side HTTP requests
- Distributed rate limiting with Upstash Redis
- Signed, HttpOnly admin session cookies
- Same-origin protection for authenticated state-changing requests
- Secure response headers
- Restricted FastAPI CORS policy
Before production deployment, configure these server-side environment variables:
ADMIN_USERNAME
ADMIN_PASSWORD
UPSTASH_REDIS_REST_URL
UPSTASH_REDIS_REST_TOKEN
FRONTEND_ORIGIN
HARDENHQ_INTERNAL_API_SECRET
Never expose admin or Redis credentials through NEXT_PUBLIC_* variables.
- Next.js
- React
- TypeScript
- Tailwind CSS
- Node.js
- FastAPI
- Python
- Upstash Redis
app/
components/
hooks/
lib/
backend/
public/
git clone https://github.com/SamRepository25/HardenHQ.git
cd HardenHQnpm installnpm run devOpen:
http://localhost:3000
npm run buildStart production server:
npm startThe production start command enables the SSRF egress guard automatically.
- HTTPS Availability
- TLS certificate information
- Security Headers
- Strict-Transport-Security
- Content-Security-Policy
- X-Frame-Options
- X-Content-Type-Options
- Referrer-Policy
- Permissions-Policy
- Cookie security
- Redirect chain
- Server information exposure
- Overall Security Score
- Security Recommendations
- Raw Response Headers
Added screenshots inside:
docs/
Example:
docs/home.png
docs/results.png
- Advanced TLS Analysis
- Security History Improvements
- API Improvements
- Expanded security checks
Contributions, suggestions, and bug reports are welcome.
Feel free to open an issue or submit a pull request.
This project is licensed under the MIT License.
B SIMAK AHMED