httpx takes a list of hostnames, URLs, IPs or CIDR ranges and tells you which ones answer over HTTP and what they are. For each live host it reports the status code, page title, content length, web server, redirect target, TLS certificate details and response time by default, and on request adds technology detection from the Wappalyzer dataset, CDN and WAF detection, favicon and JARM hashes, ASN lookups, virtual host checks and headless-browser screenshots. Filters and matchers let you keep only, say, the 200 responses running a given framework.
It is the middle step of ProjectDiscovery's recon chain. subfinder produces a few thousand names; httpx narrows them to the few hundred that actually serve something and labels each one, and katana then crawls the interesting ones. Because it reads stdin and writes plain lines or JSON, it slots just as easily after Amass, a DNS export or a Burp Suite file.
It is MIT-licensed and maintained by ProjectDiscovery, with about 10,600 stars, 131 contributors and 68 releases since 2020. The last push was on 28 October 2026 and v1.12.0 came out on 8 September. The README warns that breaking changes are common and that it is built as a CLI, not a service.
- Repository: github.com/projectdiscovery/httpx
- Licence: MIT (MIT License)
- Language: Go. Stars: 10.6K. Forks: 1,111. Last push: Oct 28, 2026.
- Scan: safe, Oct 28, 2026, commit 668a37c
Who it is for
Security and IT teams checking which of their hosts expose web services, bug bounty hunters triaging in-scope subdomains, and anyone who needs to turn a long list of names into a labelled list of live websites.
Getting started
1. Install with Go (needs Go 1.26.10 or later; release binaries and a projectdiscovery/httpx Docker image also exist)
go install -v github.com/projectdiscovery/httpx/cmd/httpx@latest2. Probe a list of hosts and show status, title and detected technology
httpx -l hosts.txt -status-code -title -tech-detect3. Or chain it after subfinder
subfinder -d example.com -silent | httpx -silent -sc -titleIf you installed Python's httpx with its command-line extra (httpx[cli]), its httpx command may sit earlier on your PATH; httpx -version only works on the Go tool, so it is a quick check. httpx sends real requests to every host you give it, so feed it only hosts you are allowed to probe. Add -duc to skip the update check.
Safety scan
We cloned projectdiscovery/httpx at commit 668a37c on Oct 28, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no pattern hits and no committed binaries across 139 files and about 20,000 lines of Go. The many example.com, foo.com and scanme.sh hosts in the scan are test fixtures; scanme.sh is ProjectDiscovery's own target for tests.
- The two installer scripts flagged, cmd/functional-test/run.sh and integration_tests/run.sh, are short CI helpers that build httpx and run its test suites. No sudo, no downloads piped to a shell.
- Like subfinder and katana, httpx uses ProjectDiscovery's shared update check, which calls api.pdtm.sh with your OS, architecture, Go and httpx versions and a salted machine ID. Results only go to ProjectDiscovery Cloud if you pass -dashboard or -pdu with an API key.
- go.mod pins 158 packages with 4 advisories, none rated: two golang.org/x/net HTML parser issues, a goldmark Markdown XSS and the deprecated openpgp package. All are indirect, and none affects httpx's job of sending requests and reading replies.
- Nine workflows, none using pull_request_target; the 12 third-party action uses are pinned to tags, not commits. Dependabot and CodeQL are enabled; the security policy is inherited from the ProjectDiscovery organisation.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | 2 installer scripts |
| Committed binaries | None. |
| CI workflows | 9 workflows. None use pull_request_target. 12 of 12 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often github.com, foo.com, a.example.com, b.example.com. No URLs to bare IP addresses. |
| Known vulnerabilities | 4 advisories across 158 pinned packages: 0 critical, 0 high, 0 moderate, 0 low, 4 unrated. go.mod: 158 packages, 4 advisories. |
| Project hygiene | Has automated dependency updates, CodeQL, licence file. Missing security policy, contributing guide. |
| OpenSSF Scorecard | 6.4 out of 10, as of Oct 26, 2026. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Installer scripts (2)
- cmd/functional-test/run.sh, 24 lines
- integration_tests/run.sh, 22 lines
Worst known vulnerabilities (4 of 4)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| CVE-2026-78661 | unknown | golang.org/x/net@0.61.0 | Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net |
| CVE-2026-97045 | unknown | golang.org/x/net@0.61.0 | Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net |
| GHSA-c97m-vxhj-p7j6 | unknown | github.com/yuin/goldmark@1.7.13 | Cross-site Scripting (XSS) in github.com/yuin/goldmark |
| GO-2026-5932 | unknown | golang.org/x/crypto@0.58.0 | The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues |
By the numbers
| Stars | 10.6K |
|---|---|
| Forks | 1,111 |
| Contributors | 131 |
| Commits | 2,901 |
| Open issues | 3 |
| Open pull requests | 5 |
| Releases | 68 |
| Latest release | v1.12.0 |
| Licence | MIT |
| Main language | Go |
| Project age | 6 years |
| Last push | Oct 28, 2026 |
| Tracked files | 139 |
| Lines of code | 20.1K |
| Checkout size | 2 MB |
Lines by language: Go 18.8K, YAML 535, Markdown 525, HTML 196, Shell 46.
Questions
Is httpx free?
Yes. httpx is MIT-licensed and free for any use, commercial included. The optional ProjectDiscovery Cloud dashboard has its own free and paid plans, but the CLI does not need it.
Is it legal to run httpx against websites?
httpx makes ordinary web requests, similar to opening each site in a browser, but sending thousands of them to systems you do not own can break terms of service or computer misuse laws, especially with options like -ports or -path that look like scanning. Use it on your own hosts, a client's with written permission, or a bug bounty's listed scope.
Is this the same as the Python httpx library?
No. Python's httpx is an HTTP client library by Encode; this httpx is ProjectDiscovery's Go command-line prober. They share a name only. Installing the Python one with its CLI extra adds a second httpx command, and your shell may pick it first; httpx -version answers only from the Go tool.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.