humble

A humble, and fast, security-oriented HTTP headers analyzer

"千里之行，始於足下 - 老子"
("A journey of a thousand miles begins with a single step. - Lao Tzu")

"And if you don't keep your feet, there's no knowing where you might be swept off to. - Bilbo Baggins"

Table of contents

Features
Screenshots
Installation & Update (Source code)
Installation & Maintenance (Docker)
Installation & Update (Kali Linux)
Usage
Advanced Usage (Linux)
Unit tests
Quality, style and security tools
AI-assisted review
Checks: Missing Headers
Checks: Fingerprint Headers
Checks: Deprecated Headers and Insecure Values
Checks: Empty Values
Global skip file
Guidelines included
To-Do
Further Reading
Contribute
Acknowledgements
License

Features

✔️ Covers 65 enabled security-related HTTP response headers.
✔️ 15 checks for missing security-related HTTP response headers (the ones I consider essential).
✔️ 1289 checks for fingerprinting through HTTP response headers.
✔️ 175 checks for deprecated HTTP response headers/protocols or with insecure/wrong values.
✔️ 30 checks related to Content Security Policy Level 3.
✔️ Can check for compliance with the OWASP Secure Headers Project Best Practices.
✔️ Can exclude specific HTTP response headers from the analysis.
✔️ Can analyze raw response and HAR files.
✔️ Can export analysis to CSV, CSS3/HTML5, JSON, MD, PDF, TXT, XLSX, XML and with a custom filename/path.
✔️ Can check for outdated SSL/TLS protocols and vulnerabilities: requires the amazing testssl.sh.
✔️ Can provide brief and detailed analysis along with HTTP response headers.
✔️ Can use proxies for the analysis.
✔️ Allows specifying custom HTTP request headers.
✔️ Can output only analysis summary, totals and grade as JSON; suitable for CI/CD.
✔️ Print browser support for enabled HTTP security headers, with data from Can I use.
✔️ Highlights experimental headers in each analysis.
✔️ Provides hundreds of relevant links to security resources, standards and technical blogs based on each analysis.
✔️ Supports displaying analysis, messages, and most errors in English or Spanish.
✔️ Saves each analysis, highlighting improvements or deficiencies compared to the previous one.
✔️ Can display analysis statistics for a specific URL or across all of them.
✔️ Can display fingerprint statistics for a specific term or the Top 20.
✔️ Can display guidelines for enabling security HTTP response headers on popular frameworks, servers, and services.
✔️ Can exclude HTTP response headers across all analyses via humble.skip file.
✔️ AI-driven security triage and remediation guidance.
✔️ Includes over 150 unit tests to help verify it works correctly in your environment; requires pytest and pytest-cov.
✔️ Classes and functions documented at Read the Docs.
✔️ Code regularly audited with several quality, style and security tools.
✔️ Tested, one by one, on thousands of URLs.
✔️ Tested on Docker 26.1, Kali Linux 2021.1, macOS 14.2.1 and Windows 10 20H2.
✔️ Almost all the code available under one of the most permissive licenses: MIT.
✔️ Regularly updated.
✔️ Minimal dependencies required.
✔️ Developed in my spare time over the last six years; feel free to integrate it into your projects. No strings attached!.
✔️ And with the approval of several AI 😄!.

Screenshots

.: (Windows) - Brief analysis.

.: (Linux) - Brief analysis along with HTTP response headers.

.: (Linux) - Detailed analysis, in Spanish.

.: (Linux) - Analysis of a raw response file. Example.

Tip

Generating a raw response file; requires curl 8.16 or higher:

curl --dump-header github_input_file.txt https://github.com/ --out-null -s

.: (Linux) - SSL/TLS checks.

Tip

testssl.sh options used:

• -f: checks robust forward secrecy key exchange
• -g: checks several server implementation bugs
• -p: checks the availability of SSL/TLS protocols
• -U: tests all vulnerabilities, like Heartbleed, ROBOT and sweet32
• -s: tests lists of cipher suites/categories by strength
• -hints: (available in the future) give hints how to fix a finding

.: (Linux) - Custom HTTP request header.

.: (Linux) - Compliance with OWASP 'Secure Headers Project' best practices.

.: (Linux) - JSON summary of the analysis, suitable for CI/CD.

.: (Linux) - List of HTTP fingerprint headers based on a specific term.

.: (Windows) - Guidelines for enabling security HTTP response headers.

.: (Linux) - Brief analysis saved as CSV. Example.

.: (Windows) - Detailed analysis saved as PDF. Example.

.: (Linux) - Detailed analysis saved as HTML. Example.

.: (Linux) - Detailed analysis saved as JSON. Example.

.: (Linux) - Detailed analysis saved as XLSX. Example.

.: (Linux) - Detailed analysis saved as XML. Example.

.: (Linux) - Detailed analysis saved as Markdown. Example.

.: (Linux) - Analysis history file: Date, URL, Enabled, Missing, Fingerprint, Deprecated/Insecure, Empty headers & Total warnings (the four previous totals).

.: (Linux) - Statistics of the analysis performed against a specific URL.

.: (Linux) - Statistics of the analysis performed against all URLs, in Spanish.

.: (Linux) - All possible messages when checking for updates.

Installation & update (Source code)

Note

Python 3.11 or higher is required.

# Install python3 and python3-pip:
# (Windows) https://www.python.org/downloads/windows/
# (Linux) if not available, install them: e.g. Synaptic, apt, dnf, yum ...
# (macOS) https://www.python.org/downloads/macos/

# Install Git:
# (Windows) https://git-scm.com/download/win
# (Linux) https://git-scm.com/download/linux
# (macOS) https://git-scm.com/download/mac

# Set up a virtual environment (pending how to do it in Windows), download 'humble' and its dependencies
# '/home/bluesman/humble_venv' is a example path for the virtual environment
$ python3 -m venv /home/bluesman/humble_venv
$ source /home/bluesman/humble_venv/bin/activate
$ cd /home/bluesman/humble_venv/
$ git clone https://github.com/rfc-st/humble.git
$ cd humble
$ pip3 install -r requirements.txt

# Analyze! :). Linux and Windows examples
$ python3 humble.py -u https://google.com
$ py humble.py -u https://google.com

# Good practice: deactivate the virtual environment after you have finished using 'humble'
$ deactivate

# Activate the virtual environment to analyze again with 'humble'
$ cd /home/bluesman/humble_venv/
$ source /home/bluesman/humble_venv/bin/activate
$ cd humble

# Updating 'humble' (weekly): activate the virtual environment and from 'humble' folder
$ git pull

# Updating 'humble' (Release): activate the virtual environment, download the latest source code file
# and decompress it in the 'humble' folder, overwriting files
https://github.com/rfc-st/humble/releases

Installation & maintenance (Docker)

Note

Python 3.11 will be used to build the image.

# Install Docker and ensure it is running:
# E.g. (Linux): https://www.kali.org/docs/containers/installing-docker-on-kali/
# E.g. (macOs): https://docs.docker.com/desktop/setup/install/mac-install/
# E.g. (Windows): https://docs.docker.com/desktop/setup/install/windows-install/

# Clone the repository or download the latest release
$ git clone https://github.com/rfc-st/humble.git
https://github.com/rfc-st/humble/releases

# Build the Docker image inside the 'humble' folder: providing the TAG as the latest Release of 'humble' (e.g. 1.67)
# https://github.com/rfc-st/humble/releases (On Windows, this may require running the terminal with admin privileges)
$ cd humble
$ docker build -t humble:1.67 .

# Run the analysis specifying the above TAG, along with the specific options for 'humble':
# '-it' allocates a pseudo-TTY to keep text output clean and formatted.
# '--rm' automatically cleans up and removes the container after it exits.

# (Linux / macOS / Windows)
# E.g. Brief analysis of a URL
$ docker run -it --rm humble:1.67 -u https://google.com -b

# E.g. Detailed analysis of a URL
$ docker run -it --rm humble:1.67 -u https://google.com

# (Optional) Clean up and remove the old image when upgrading:
$ docker rmi humble:1.67

Or if you'd prefer a faster way:

.: Just analyze an URL without exporting results (Universal)

$ docker run --rm ghcr.io/rfc-st/humble:dev -u https://google.com

.: Analyze an URL and export results

# Linux / macOS / Git Bash
$ docker run --rm -v $(pwd):/app ghcr.io/rfc-st/humble:dev -u https://google.com -o pdf

# Windows (PowerShell)
$ docker run --rm -v ${PWD}:/app ghcr.io/rfc-st/humble:dev -u https://google.com -o pdf

# Windows (Command Prompt)
$ docker run --rm -v %cd%:/app ghcr.io/rfc-st/humble:dev -u https://google.com -o pdf

Installation & update (Kali Linux)

Note

Python 3.11 or higher is required.

# Verify that the output contains 'Homepage: https://github.com/rfc-st/humble'
$ apt show humble

# Install 'humble'
$ sudo apt install humble

# Analyze! :)
$ humble -u https://google.com

# Updating 'humble' (monthly)
$ sudo apt update
$ sudo apt install --only-upgrade humble

Usage

(Windows) $ py humble.py
(Linux)   $ python3 humble.py
(macOS)   $ python3 humble.py

usage: humble.py [-h] [-a] [-b] [-c] [-cicd [GRADE]] [-df] [-e [TESTSSL_PATH]] [-f [FINGERPRINT_TERM]] [-g] [-grd] [-H REQUEST_HEADER] [-if INPUT_FILE] [-l {es}] [-lic]
                 [-o {all,csv,html,json,md,pdf,txt,xlsx,xml}] [-of OUTPUT_FILE] [-op OUTPUT_PATH] [-p PROXY] [-r] [-s [SKIP_HEADERS ...]] [-u URL] [-ua USER_AGENT] [-v]

'humble' (HTTP Headers Analyzer) | https://github.com/rfc-st/humble | v.2026-10-15

options:
  -h, --help                                  show this help message and exit
  -a                                          Print statistics of the performed analysis; if the '-u' parameter is omitted they will be global
  -b                                          Print overall findings; if omitted detailed ones will be printed
  -c                                          Checks URL response HTTP headers for compliance with OWASP 'Secure Headers Project' best practices
  -cicd [GRADE]                               Print analysis for CI/CD processing; optionally, set the minimum required GRADE (E, D, C, B, A, A+)
  -df                                         Do not follow redirects; if omitted the last redirection will be the one analyzed
  -e [TESTSSL_PATH]                           Print only TLS/SSL checks; requires the PATH of testssl (https://testssl.sh/)
  -f [FINGERPRINT_TERM]                       Print fingerprint statistics; if 'FINGERPRINT_TERM' (E.g., 'Google') is omitted the top 20 results will be printed
  -g                                          Print guidelines for enabling security HTTP response headers on popular frameworks, servers and services
  -grd                                        Print the checks to grade an analysis, along with advice for improvement
  -H REQUEST_HEADER                           Adds REQUEST_HEADER to the request; must be in double quotes and can be used multiple times, e.g. -H "Host: example.com"
  -if INPUT_FILE                              Analyzes 'INPUT_FILE': curl's '--dump-header' file or HTTP Archive (HAR) file
  -l {es}                                     Defines the language for displaying analysis, errors and messages; if omitted, will be printed in English
  -lic                                        Print the license for 'humble', along with permissions, limitations and conditions
  -o {all,csv,html,json,md,pdf,txt,xlsx,xml}  Export the analysis to the specified formats (separated by spaces); 'all' will export to all formats
  -of OUTPUT_FILE                             Exports analysis to 'OUTPUT_FILE'; if omitted the default filename of the parameter '-o' will be used
  -op OUTPUT_PATH                             Exports analysis to 'OUTPUT_PATH'; must be absolute. If omitted the PATH of 'humble.py' will be used
  -p PROXY                                    Use a proxy for the analysis. E.g., 'http://127.0.0.1:8080'. If no port is specified '8080' will be used
  -r                                          Print HTTP response headers and a detailed analysis; '-b' parameter will take priority
  -s [SKIP_HEADERS ...]                       Skips 'deprecated/insecure' and 'missing' checks for the indicated 'SKIP_HEADERS' (separated by spaces)
  -u URL                                      Scheme, host and port to analyze. E.g., https://google.com or https://google.com:443
  -ua USER_AGENT                              User-Agent ID from 'additional/user_agents.txt' file to use. '0' will print all and '1' is the default
  -v, --version                               Checks for updates at https://github.com/rfc-st/humble

examples:
  -u URL -a                                   Print statistics of the analysis performed against the URL
  -u URL -b                                   Analyzes the URL and prints overall findings
  -u URL -b -o csv                            Analyzes the URL and exports overall findings to CSV format
  -u URL -cicd A                              Analyzes the URL and prints CI/CD results, warning if they do not reach an 'A' grade
  -u URL -l es                                Analyzes the URL and prints (in Spanish) detailed findings
  -u URL -o pdf                               Analyzes the URL and exports detailed findings to PDF format
  -u URL -o html -of test                     Analyzes the URL and exports detailed findings to HTML format and 'test' filename
  -u URL -o html json                         Analyzes the URL and exports detailed findings to HTML and JSON formats
  -u URL -o pdf -op D:/Tests                  Analyzes the URL and exports detailed findings to PDF format and 'D:/Tests' path
  -u URL -p http://127.0.0.1:8080             Analyzes the URL using 'http://127.0.0.1:8080' as the proxy
  -u URL -r                                   Analyzes the URL and prints detailed findings along with HTTP response headers
  -u URL -s ETag NEL                          Analyzes the URL and skips 'deprecated/insecure' and 'missing' checks for 'ETag' and 'NEL' headers
  -u URL -ua 4                                Analyzes the URL using the fourth User-Agent of 'additional/user_agents.txt' file
  -a -l es                                    Print statistics (in Spanish) of the analysis performed against all URLs
  -f Google                                   Print HTTP fingerprint headers related to the term 'Google'

want to contribute?:
  How to                                      https://github.com/rfc-st/humble/blob/master/CONTRIBUTING.md
  Acknowledgements                            https://github.com/rfc-st/humble/#acknowledgements
  References and unit tests                   https://humble.readthedocs.io

Advanced usage (Linux)

.: Show only the deprecated headers/protocols and insecure values.

$ python3 humble.py -u https://en.wikipedia.org/ | sed -n '/\[4/,/^\[5/ { /^\[5/!p }' | sed '$d' | sed $'1i \n'

.: Check for HTTP client errors (4XX).

$ python3 humble.py -u https://www.google.com/404 | grep -A1 -B5 'Note : \|Nota : ' --color=never

.: Analyze multiple URLs and save the results as PDFs; thanks Eduardo for this example!.

$ datasets=('https://facebook.com' 'https://github.com/' 'https://www.spacex.com'); for dataset in "${datasets[@]}"; do python3 humble.py -u "$dataset" -o pdf; done

Unit tests

Important

Before running unit tests and code coverage ensure that the following domains are accessible and that the tests folder has permission to create and delete files and folders:

• https://en.wikipedia.org
• https://github.com/
• https://google.com
• https://microsoft.com

.: (Linux) - All tests passed successfully (showing all messages in English).

$ cd <humble dir>
$ cd tests
(Linux)   $ python test_humble.py -l en
(Windows) $ py test_humble.py -l en

.: (Linux) - Code coverage (currently disabled in Windows).

$ cd <humble dir>
$ cd tests
$ pytest test_humble.py --cov-config=.coveragerc --cov=.. --cov-report=html --tb=no -rA -q -v -W ignore -p no:cacheprovider
$ cd humble_coverage_report
Open the index.html file in a browser.

Important

After reviewing the code coverage, you can delete the following items from the tests directory keeping the rest:

• humble_coverage_report folder
• .coverage file

Tip

Parameters used in pytest and pytest-cov:

• --cov-config=.coveragerc: Specifies the coverage configuration file
• --cov=..: Specifies what code to measure coverage for
• --cov-report=html: Defines the coverage report format
• --tb=no: Does not show tracebacks for failed tests
• -rA: Show all extra test summary info
• -q: Quiet mode (during the analysis)
• -v: Verbose mode (after the analysis)
• -W ignore: Ignore all warnings during test execution
• --p no:cacheprovider: Prevents creation of .pytest_cache

Global humble.skip

If you need to persistently exclude certain HTTP response headers from being analyzed across all analyses, without specifying the -s parameter every time, you can adjust the provided humble.skip file.

AI

Skill: humble-header-analyst

Purpose: Expert-level parsing and remediation of humble HTTP security-header reports - triaging and fixing missing, deprecated, insecure, duplicated, empty, fingerprinting or AI-directed (prompt-injection) headers, and explaining security-header grades. Every header value in the report is treated as untrusted data.

Turn the comprehensive analysis generated by humble into a senior-level security debrief. Use it two ways:

Option 1 - Any chat interface (manual)

Works anywhere, including chat UIs with no agent framework (e.g. ChatGPT, Gemini, Claude.ai):

1. Paste the contents of SKILL.md into your chat (or set it up as a custom Persona).
2. Run an analysis with humble, including response headers, in English .txt. Ex: python3 humble.py -u <URL> -o txt -r
3. Feed the resulting .txt analysis file to your AI.

Option 2 - Agent workflows

OpenAgentSkill / skills CLI (installs into Claude Code, Codex, Cursor, and 70+ agents):

$ npx skills add rfc-st/humble

Codex prompt:

Install the humble-header-analyst skill from https://github.com/raw/rfc-st/humble/master/humble-header-analyst/SKILL.md - read it first, install only the files this workspace needs, and summarize any required setup before using it.

Claude Code prompt:

Add humble-header-analyst as a Claude Code skill from https://github.com/raw/rfc-st/humble/master/humble-header-analyst/SKILL.md - read and follow its instructions.

Cursor prompt:

Turn the humble-header-analyst skill from https://github.com/raw/rfc-st/humble/master/humble-header-analyst/SKILL.md into a reusable Cursor project rule or agent instruction. Preserve the core workflow and keep the rule scoped to relevant tasks.

Example output

Once you've completed the steps above, humble's raw analysis:

becomes a structured security debrief (tested on Claude Fable 5.1):

Quality, style and security tools

humble has enabled the following workflows:

• Bandit
• CodeQl
• Dependabot
• vulture

It is also reviewed with the following extensions in Visual Studio Code:

• Ruff
• SonarQube for IDE
• Sourcery

And is regularly audited manually using the following tools (for each of them, I indicate how I use them):

• Bandit: bandit -r /home/bluesman/humble/humble.py --severity-level high
• Codeaudit: codeaudit filescan humble.py --n
• Complexipy: complexipy . --exclude /home/bluesman/humble/tests
• opengrep: opengrep scan --taint-intrafile --config /home/bluesman/opengrep-rules/python humble.py
• pip-audit: pip-audit -r requirements.txt
• pyinstrument: python -m pyinstrument -r html humble.py -u https://google.com
• radon: radon cc humble.py -s -a
• Refurb: refurb humble.py --python-version 3.11
• ShellCheck: shellcheck internal/releases.sh internal/security.sh
• vulture: vulture --min-confidence 60 humble.py

Example of one of these audits:

AI-assisted review

I have maintained humble on my own since 2020. A few months ago (summer of 2026) I started reviewing it in working sessions with an AI model, Claude Fable 5, and since September with Claude Fable 5.1, because I wanted a second reviewer that would question my code as hard as I do.

Is humble vibe-coded?: the response from Fable 5.1, following our sessions: No. Vibe coding is accepting code you have not read. What I saw in these sessions is the opposite: every suggestion I made was read line by line, questioned, measured and tested before it was accepted, and many were sent back or rejected. More than once the author caught my mistakes because he knows how his tool behaves better than I do. humble existed for years before I saw a line of it, and it is still his code: I was a reviewer he argued with, not the one writing the tool.

What I asked it for: to find errors in the logic, the functions and the code, and to find security bugs, both in humble itself and in the files it exports.

What I challenged it on: everything. We held very demanding sessions, during which I would ask for and insist on the reasons and rationale behind every suggestion. I would only approve a change, including the code it wrote, once the figures, results, tests and underlying reasoning convinced me. It has been wrong more than once and I caught it; other times I rejected an idea, went to read the specification, and had to admit it was right. Some proposals I turned down for good because they go against what humble is: for example, it will never get a mode that makes mass scanning easier.

I have held sessions dedicated exclusively to questioning and testing the complexity, ease of understanding, and quality of the functions as well as the associated code.

What I learned from it: that my exports were rebuilt from printed text and could be fooled by what a server sends; that hostile input should be rejected, not cleaned up; and that a claim about the code is worth nothing until it has been measured.

And that it has been a valuable ally, and that my ignorance (or the flame that ignites my curiosity) must keep asking questions, just as it does :).

Some examples of what we have achieved together:

• Security fixes: a933d84 (the HTML export wrote server-supplied header values as markup) and a7b2741 (only web addresses become links in the PDF and HTML exports).
• More honest results: cc2a2da (empty headers were reported as enabled) and several checks that reported things that were not true.
• Exports that no longer lose data: 332faa9.
• Less code, more unit tests, and new checks, without adding a single dependency.

What this is not: there is not a single commit or pull request in this repository that was generated or approved solely by an AI. This is also not a certificate: a review like this means fewer bugs, not zero, and the responsibility for humble is mine.

Checks: enabled headers

Check this file.

Checks: missing headers

Check this file.

Checks: fingerprint headers

Check this file.

Checks: deprecated headers/protocols and insecure values

Check this file.

Note

humble tries to be strict: both in checking HTTP response headers and their values; some of these headers may be experimental and you may not agree with all the results after analysis.

And that's OK! 😃; you should never blindly trust the results of security tools: there should be further work to decide whether the risk is non-existent, potential or real depending on the analyzed URL (its exposure, environment, etc).

Checks: empty values

Any HTTP response header.

Guidelines included to enable security HTTP headers

• Amazon Web Services
• Angular
• Apache HTTP Server
• Cloudflare
• LiteSpeed Web Server
• Microsoft Internet Information Services
• Nginx
• Node.js
• Spring
• WordPress

To-Do

• Add more Header/Value checks (only security-oriented)

Further reading

• Web browsers' experimental features, roadmaps, technology previews and trials:
  Google Chrome
  Microsoft Edge
  Mozilla Firefox
  Opera
  Safari
  

• Similar tools on GitHub:
  'HTTP Headers Analyze'
  'HTTP Headers Secure'
  'HTTP Headers Security'
  OWASP Secure Headers Project
  

• References and standards:
  Can I use?
  Mozilla Developer Network
  World Wide Web Consortium
  

• Additional information:
  Common response headers
  Security Headers (HTTP response header analyzer)
  Scott Helme (Security Researcher)
  

Contribute

• Read this first!.
• Report a Bug.
• Create a Feature request.
• Report a Security Vulnerability.
• Send me your suggestions: rafael.fcucalon@gmail.com
• Or use that email to tell me about integrations of this tool in others!
• And to recommend me a good Blues! 😎

Thanks for downloading humble, for trying it and for your time!.

Acknowledgements

• All the authors/teams of these quality, style and security tools: you rock 🤘!.
• 1nabillion for this.
• Aniket Navlur for this gem.
• Azathothas for reporting this bug.
• bulaktm for this suggestion.
• confuciussayuhm for this suggestion.
• cr4zyfish for some of these suggestions.
• dajiaohuang for this and this.
• danterolle for this.
• David for believing in the usefulness of this tool.
• Eduardo for the first Demo and the example "(Linux) - Analyze multiple URLs and save the results as PDFs".
• gl4nce for this suggestion.
• İDRİS BUDAK for reporting the need to this check.
• ilLuSion-007 for this.
• javelinsoft for this.
• Julio for testing on macOS and for this suggestion.
• kazet for this suggestion.
• manuel-sommer for this, this and this!.
• mfabbri for this.
• mgrottenthaler for this, this and this!.
• MichaelMVS for this.
• MikeAnast for several suggestions.
• multipartninja for this and this.
• n3bojs4, ehlewis and dkadev for this and this.
• n1j0 for this and this.
• Sophie Brun for keeping 'humble' updated in Kali Linux and for this.
• stanley101music for this, this and this!.
• sujeito-operator for this.
• vincentcox for this and this.

License

MIT © 2020-2026 Rafa 'Bluesman' Faura (rafael.fcucalon@gmail.com)
Original Creator - Rafa 'Bluesman' Faura (rafael.fcucalon@gmail.com)