httpx
A command-line tool that quickly checks many web hosts and reports details about each one.
- Stars
- 10.6k
- Forks
- 1.1k
- Licence
- MIT
- Language
- Go
- Last update
- 4 days ago
- Type
- CLI
What it is
httpx is a command-line program that sends HTTP requests to a list of hosts, URLs, or IP ranges and reports what each one returns, such as status code, page title, server name, and TLS certificate details. It is built on the retryablehttp library and is designed to stay reliable when many threads run at once. People use it to quickly survey large sets of web servers, for example during security testing or research.
- Check a file of hostnames and list which ones respond, along with status codes and page titles
- Filter responses by status code, content length, or regex match using the matcher and filter flags
- Detect technologies in use on a site with the tech-detect flag
- Inspect TLS certificates and response times across many hosts
- Take screenshots of pages using the headless option
Great for
- Security testers doing reconnaissance on lists of hosts they are authorized to test
- Bug bounty hunters who need to filter large lists of subdomains down to live web servers
- Researchers gathering metadata about many websites at once
- Developers who want a scriptable way to check many URLs and pipe results to other tools
Not ideal for
- People who want a visual web browser or point-and-click interface, since it is a command-line tool
- Anyone probing systems they do not have permission to scan, because it can generate heavy traffic and is widely used for pentesting
- Users who need to run it as an always-on public service, since the README warns that running it as a service may pose security risks
How to get it
- 1
Install with a package manager
You'll need: Go 1.26.10 or newer
Install httpx with Go
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest - 2
Run it
- Install Go 1.26.10 or newer
- Run the go install command shown above
- Run httpx -h to see the available flags
- Pass a list of hosts with -l or a single target with -u, and choose the probes you want, such as -sc or -title
- 3
Get the most out of it
- Use -tech-detect to identify the technologies a site runs on
- Use matcher flags such as -mc and -ms to keep only responses you care about
- Use filter flags such as -fc and -fd to remove noise and near-duplicate responses
- Use -extract-fqdn to pull domains and subdomains out of response bodies and headers
- Use -screenshot with headless options if you need page captures, after checking the docs for setup
Downloads
Strengths
- Fast, with many configurable probe flags covering status, title, TLS, hashes, and more
- Supports hosts, URLs, and CIDR ranges as input and can fall back from https to http automatically
- Includes retries and backoffs intended to handle web application firewalls
Trade-offs
- The README says the project is in active development and may have breaking changes between releases
- Its main purpose is as a standalone CLI tool, and the README cautions about running it as a service
- Some features, such as headless screenshots and certain probes, are off by default and need extra setup or flags
How it compares
| Project | Stars | Type | Level | Updated | Best for |
|---|---|---|---|---|---|
| httpx (this) | 10.6k | CLI | intermediate | 4 days ago | Security testers doing reconnaissance on lists of hosts they are authorized to test |
| ffuf | 17k | CLI | intermediate | 1 months ago | Security testers doing authorized web content discovery |
| sherlock | 95.4k | CLI | intermediate | 4 days ago | Security researchers doing authorized open-source intelligence work |
| subfinder | 14.7k | CLI | intermediate | 4 days ago | Security testers doing reconnaissance on a domain they are authorized to test |
| spiderfoot | 24.2k | App | intermediate | 7 months ago | Security professionals doing reconnaissance during penetration tests or red team exercises |
| maigret | 39.6k | App | intermediate | 4 days ago | Investigators and analysts doing OSINT research on a username |
Stats synced from GitHub. The assessment above was drafted with AI from the project's README on 2026-10-29 and may miss recent changes — check the README before relying on a command. MIT licence: free to use, modify and distribute, including commercially, as long as you keep the copyright notice.