Security Headers Checker

Grade a website’s HTTP security from A+ to F: HTTPS redirect, HSTS (preload), Content-Security-Policy, framing, cookies, CORS, mixed content and version leaks.

Result

Press “Run” to see the result.

The security headers API fetches a URL and reviews the protections browsers apply from its response: an HTTPS redirect from http://, Strict-Transport-Security (max-age, includeSubDomains and whether the site is eligible for the HSTS preload list), Content-Security-Policy (flagging unsafe-inline without nonces, unsafe-eval and wildcard script sources), clickjacking protection with X-Frame-Options or frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and the cross-origin isolation headers.

It also checks the flags of the cookies the page sets (Secure, HttpOnly, SameSite), dangerous CORS combinations (* with credentials), resources loaded over http:// on an https page (mixed content) and headers that reveal software versions. Each finding is a check with a status and a message in English or Vietnamese (lang=vi); the score and grade (A+ when nothing is left to improve) summarise them.

The parsed HSTS and CSP directives, the cookies and all response headers are returned for your own rules. Results are cached for 10 minutes (fresh=true to re-check).

Use this in your code

curl "https://apibox.io.vn/v1/security-headers?url=https://github.com/" \
  -H "Authorization: Bearer YOUR_API_KEY"

const res = await fetch('https://apibox.io.vn/v1/security-headers?url=https://github.com/', {
  method: 'GET',
  headers: {
    Authorization: 'Bearer YOUR_API_KEY',
  },
});
const data = await res.json();
console.log(data);

import requests

res = requests.get(
    "https://apibox.io.vn/v1/security-headers?url=https://github.com/",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/security-headers?url=https://github.com/');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY'],
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

API documentation → Get a free API key

FAQ

What does A+ mean?

A score of 90 or more with no warning or failure left: HTTPS with redirect, a long HSTS, a script-restricting CSP, framing protection, nosniff and a Referrer-Policy.

Is unsafe-inline always bad?

For scripts it disables most of the XSS protection of CSP, unless nonces or hashes are used (then browsers ignore it). For styles the risk is lower and it is not penalised.

Does it scan for vulnerabilities?

No. It only reads one response like a browser does; it does not probe the site.