Not using any external scripts, I get a score of 110.

Results are cached from 2h0m30s ago; use -r to rescan.

Score: 110 [A+]
Modifiers:
    [  +5] HTTP Public Key Pinning (HPKP) header set to a minimum of 15 days (1296000)
    [  +5] Preloaded via the HTTP Strict Transport Security (HSTS) preloading process

Using external scripts with SRI gets them 11 points.

Results are cached from 2h0m27s ago; use -r to rescan.

Score: 111 [A+]
Modifiers:
    [  +5] Preloaded via the HTTP Strict Transport Security (HSTS) preloading process
    [  +5] Subresource Integrity (SRI) is implemented and all scripts are loaded securely
    [  +1] HTTP Public Key Pinning (HPKP) header set to less than 15 days (1296000)

Why is using external scripts (with SRI) better than not using external scripts at all?
Sure, showing off you know SRI is a cool thing. But not relying on third-party domains for scripts (think availability) would be even better, no?

Results are cached from 2h0m2s ago; use -r to rescan.

This looks like it might be a localtime/UTC error as localtime here is UTC+2 currently.

Making the exit code the score would allow users to integrate http-observatory-cli into their build pipeline :)

Right now I'm driving it with a shell script. I'd like add another command line param to accept a file containing a list of hostnames for bulk testing and reporting.

In this mode, error messages should be saved until the testing has completed and output to stderr all at once prior to program termination to stderr, rather than having to back-scroll errors or redirect them to a file.

I tested jsq.bondsrv.com by running httpobs jsq.bondsrv.com and get among other messages the note that X-Frame-Options (XFO) header cannot be recognized. If I check the server response with f.ex. Chrome developer tools I can see that the headers include X-Frame-Options twice:

X-Frame-Options:SAMEORIGIN
X-Frame-Options:SAMEORIGIN

In the tool source you mention that having this header multiple times is common and I agree. It's set onece by nginx for all sites and in this case a second time by WordPress.

I'm wondering why the test fails in my case?

As of January 1 2019, Mozilla requires that all GitHub projects include this CODE_OF_CONDUCT.md file in the project root. The file has two parts:

1. Required Text - All text under the headings Community Participation Guidelines and How to Report, are required, and should not be altered.
2. Optional Text - The Project Specific Etiquette heading provides a space to speak more specifically about ways people can work effectively and inclusively together. Some examples of those can be found on the Firefox Debugger project, and Common Voice. (The optional part is commented out in the raw template file, and will not be visible until you modify and uncomment that part.)

If you have any questions about this file, or Code of Conduct policies and procedures, please see Mozilla-GitHub-Standards or email [email protected].

(Message COC001)

FYI: The following changes were made to this repository's wiki:

• defacing spam has been removed

• Restricting write access to contributors is strongly encouraged. Please make that change (documentation).

These were made as the result of a recent automated defacement of publically writeable wikis.

For now output of the tool are hard to parse:

Score: 0 [F]
Modifiers:
    [  -5] X-Content-Type-Options header not implemented
    [ -10] X-XSS-Protection header not implemented
    [ -20] Does not redirect to an HTTPS site
    [ -20] HTTP Strict Transport Security (HSTS) header cannot be set for sites not available over HTTPS
    [ -20] X-Frame-Options (XFO) header not implemented
    [ -25] Content Security Policy (CSP) header not implemented
    [ -50] Content is visible via cross-origin resource sharing (CORS) file or headers

Could be good to have an option to provide JSON ouput.

So, Python is Awesome, I hear, but I am a chauvinist who only does the new thing, and values purity over sense. Therefore I want a client for node.

STR for Ubuntu 14.04.4 LTS using Python 2.7.6

1. virtualenv foo
2. source foo/bin/activate
3. pip install httpobs-cli
4. httpobs-cli <something that redirects to https, e.g., 0e.vc>

  InsecurePlatformWarning
/home/freddy/opt/httpobs-cli/venv/local/lib/python2.7/site-packages/requests/packages/urllib3/util/ssl_.py:120: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. For more information, see https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning.
  InsecurePlatformWarning
Results are cached from 2h0m30s ago; use -r to rescan.

Score: 0 [F]
Modifiers:
    [  -5] X-Content-Type-Options header not implemented
    [ -10] X-XSS-Protection header not implemented
    [ -20] Does not redirect to an https site
    [ -20] HTTP Strict Transport Security (HSTS) header not implemented
    [ -20] X-Frame-Options (XFO) header not implemented
    [ -25] Content Security Policy (CSP) header not implemented

Does this not work for scanning sites pre-production i.e. internal only?

I tried entering a few internal ip's/localhost and got this warning:
Unable to get result from the HTTP Observatory.

It would be useful to be able to run the CLI with exit codes and output like a Nagios plugin.

The main points are

• all output on one line with clear OK, WARNING, CRITICAL, UNKNOWN at the start of the line
• exit codes 0 for OK, 1 for WARNING, 2 for CRITICAL, 3 for UNKNOWN

for details see https://nagios-plugins.org/doc/guidelines.html )

For this it might also be useful to be able to whitelist or suppress individual known bad tests.

This would allow use of the CLI in Nagios, Icinga and many other monitoring systems supporting this standard.