Security headers

GET /api/v1/security-headers

Grade a page's HTTP security headers — HSTS, CSP, X-Frame-Options and the rest — like securityheaders.com, plus mixed-content and cache/compression checks. Something the SEO tools don't offer for free.

Query parameters

NameTypeDescription
url requiredstringThe URL to check.
keystringYour API key. Optional for light use; raises your rate limit.

Request

Response

200 · application/json
  1. {
  2. "url": "https://example.com",
  3. "https": true,
  4. "grade": "E",
  5. "score": 12,
  6. "headers": {
  7. "strictTransportSecurity": null,
  8. "contentSecurityPolicy": null,
  9. "xContentTypeOptions": "nosniff",
  10. "xFrameOptions": null,
  11. "referrerPolicy": null,
  12. "permissionsPolicy": null,
  13. "crossOriginOpenerPolicy": null,
  14. "crossOriginEmbedderPolicy": null,
  15. "crossOriginResourcePolicy": null
  16. },
  17. "cspWeaknesses": [],
  18. "missing": ["strictTransportSecurity","contentSecurityPolicy","xFrameOptions","referrerPolicy"],
  19. "transport": {
  20. "compression": "br",
  21. "cacheControl": "max-age=3600",
  22. "etag": "\"abc\"",
  23. "lastModified": null,
  24. "server": "cloudflare"
  25. },
  26. "issues": {
  27. "noHsts": true,
  28. "noCsp": true,
  29. "mixedContentCount": 0,
  30. "mixedContent": [],
  31. "unsafeTargetBlank": 2
  32. }
  33. }

Response fields

FieldTypeDescription
httpsbooleanWhether the page was served over HTTPS.
gradestringOverall grade A–F from the weighted presence of the core headers. Serving over plain HTTP caps the grade hard.
scoreinteger0–100 score behind the grade — weighted presence of the core security headers, with only partial credit for a weak CSP.
headers.strictTransportSecuritystringThe Strict-Transport-Security (HSTS) header value, or null if absent.
headers.contentSecurityPolicystringThe Content-Security-Policy header value, or null.
headers.xContentTypeOptionsstringThe X-Content-Type-Options header (e.g. nosniff), or null.
headers.xFrameOptionsstringThe X-Frame-Options header, or null.
headers.referrerPolicystringThe Referrer-Policy header, or null.
headers.permissionsPolicystringThe Permissions-Policy (or legacy Feature-Policy) header, or null.
headers.crossOriginOpenerPolicystringThe Cross-Origin-Opener-Policy header, or null.
headers.crossOriginEmbedderPolicystringThe Cross-Origin-Embedder-Policy header, or null.
headers.crossOriginResourcePolicystringThe Cross-Origin-Resource-Policy header, or null.
cspWeaknessesarrayFlags for a weak CSP — unsafe-inline, unsafe-eval, missing default-src/script-src, or wildcard sources.
missingarrayThe core headers that are absent.
transport.compressionstringThe Content-Encoding (e.g. br, gzip), or null. May read null because our fetcher requests identity encoding.
transport.cacheControlstringThe Cache-Control header, or null.
transport.etagstringThe ETag header, or null.
transport.lastModifiedstringThe Last-Modified header, or null.
transport.serverstringThe Server header, or null.
issues.mixedContentarrayHTTP sub-resources loaded on an HTTPS page (insecure mixed content).
issues.unsafeTargetBlankintegerCount of target="_blank" links missing rel="noopener".

For full rendered performance, use Lighthouse. See Errors for status codes.

← Previous
AI readiness