网站HTTP安全头检测与评分工具：批量检测CSP/HSTS/X-Frame等安全响应头、A-F等级评分、颜色编码、一键导出CSV报告

🖥️ 运行效果

🚀 实例简介

一款基于Python Tkinter的网站HTTP安全头批量检测工具。支持检测HSTS、CSP、X-Frame-Options等7项安全响应头，A-F五级评分体系，颜色编码直观展示安全等级，表格化展示检测结果，一键导出CSV报告。后台线程异步检测，界面不卡顿。适合站长安全自检、安全审计、竞品分析、合规检查等场景。

💻 核心代码

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
网站HTTP安全头检测与评分工具
功能：批量检测网站安全响应头（CSP/HSTS/X-Frame-Options等），A-F等级评分，一键导出CSV报告
作者：好例子网 (haolizi.com)
"""

import tkinter as tk
from tkinter import ttk, messagebox, filedialog
import threading
import csv
import platform
import requests
from urllib.parse import urlparse

# 中文字体配置（Linux/Mac/Windows自适应）
CHINESE_FONT = "WenQuanYi Zen Hei" if platform.system() == "Linux" else "Microsoft YaHei"

# 安全头检测规则：(头名称, 是否必须, 说明)
SECURITY_HEADERS = [
    ("Strict-Transport-Security", True, "HSTS强制HTTPS传输"),
    ("Content-Security-Policy", True, "CSP内容安全策略"),
    ("X-Frame-Options", True, "防止点击劫持"),
    ("X-Content-Type-Options", True, "防止MIME类型嗅探"),
    ("Referrer-Policy", False, "控制Referer泄露"),
    ("Permissions-Policy", False, "控制浏览器功能权限"),
    ("X-XSS-Protection", False, "XSS过滤（已废弃但建议保留）"),
]


class SecurityHeaderChecker:
    """HTTP安全头检测器"""

    def __init__(self):
        self.results = []

    def check_url(self, url):
        """检测单个URL的安全头，返回检测结果字典"""
        # 自动补全协议
        if not url.startswith("http"):
            url = "https://" + url

        result = {
            "url": url,
            "status": "未知",
            "headers": {},
            "score": 0,
            "grade": "F",
            "missing": [],
            "error": None,
        }

        try:
            resp = requests.get(url, timeout=10, headers={
                "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) SecurityHeaderChecker/1.0"
            }, allow_redirects=True)
            result["status"] = resp.status_code

            # 检查每个安全头
            score = 0
            max_score = 0
            for header_name, required, desc in SECURITY_HEADERS:
                max_score += (2 if required else 1)
                value = resp.headers.get(header_name, "")
                result["headers"][header_name] = value
                if value:
                    score += (2 if required else 1)
                else:
                    result["missing"].append(header_name)

            # 计算评分百分比并转为等级
            pct = (score / max_score * 100) if max_score > 0 else 0
            result["score"] = int(pct)
            if pct >= 90:
                result["grade"] = "A"
            elif pct >= 75:
                result["grade"] = "B"
            elif pct >= 60:
                result["grade"] = "C"

💡 适用场景

办公自动化、数据分析、快速原型开发