Security Headers Check API

Grade a website’s HTTP security from A+ to F: HTTPS redirect, HSTS (preload), Content-Security-Policy, framing, cookies, CORS, mixed content and version leaks.

Parameters

Example

curl "https://apibox.io.vn/v1/security-headers?url=https://github.com/" \
  -H "Authorization: Bearer YOUR_API_KEY"

const res = await fetch('https://apibox.io.vn/v1/security-headers?url=https://github.com/', {
  method: 'GET',
  headers: {
    Authorization: 'Bearer YOUR_API_KEY',
  },
});
const data = await res.json();
console.log(data);

import requests

res = requests.get(
    "https://apibox.io.vn/v1/security-headers?url=https://github.com/",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/security-headers?url=https://github.com/');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY'],
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

Response

{
  "url": "https://github.com/",
  "final_url": "https://github.com/",
  "status": 200,
  "score": 100,
  "grade": "A+",
  "summary": {
    "passed": 8,
    "info": 1,
    "warnings": 0,
    "errors": 0
  },
  "hsts": {
    "max_age": 31536000,
    "include_subdomains": true,
    "preload": true,
    "preload_eligible": true
  },
  "csp": {
    "default-src": "'none'",
    "frame-ancestors": "'none'",
    "…": "…"
  },
  "checks": [
    {
      "id": "http_redirect",
      "status": "pass",
      "message": "http:// redirects to https://"
    },
    {
      "id": "hsts",
      "status": "pass",
      "message": "HSTS max-age 365 days, includeSubDomains, preload",
      "value": "max-age=31536000; includeSubdomains; preload"
    },
    {
      "id": "csp",
      "status": "pass",
      "message": "Content-Security-Policy restricts scripts",
      "value": "…"
    },
    "…"
  ]
}

Use cases

• Security checklists before launching a website
• Monitor client sites in agencies and MSPs
• Security scoring in website builders and hosting panels
• Teach web security with concrete feedback

FAQ

Related APIs