Security Headers Audit — check browser protections

Security Headers Audit API

What it does

Security Headers Audit checks a webpage URL and returns a compact audit of common browser security headers. Send an http or https URL, and get back a score plus boolean flags for whether the page sends CSP, HSTS, X-Content-Type-Options, Referrer-Policy, and X-Frame-Options.

Use it when you need a quick security review during deployment, a CI gate for public pages, or a lightweight compliance check across a list of URLs. The response is easy to inspect programmatically: the score gives you the overall result, details provides additional string-based findings, and the header-specific fields tell you exactly which protections are present.

Security Headers Audit is useful for spotting missing baseline protections before they reach production. It helps developers verify that important response headers are configured on landing pages, app shells, login screens, and other internet-facing endpoints without manually opening browser tools.

Because the input is just a webpage URL, you can plug it into automated checks, internal audits, or scheduled monitoring workflows where you need a fast yes/no view of header coverage.

What you'll get back

Returns a JSON object with these top-level fields:

score (string)

details (object with string values)

has_csp (boolean)

has_hsts (boolean)

has_x_content_type (boolean)

has_referrer_policy (boolean)

has_x_frame_options (boolean)

Example response:

{
  "has_hsts": true,
  "has_csp": false,
  "has_x_frame_options": true,
  "has_x_content_type": true,
  "has_referrer_policy": true,
  "score": "B",
  "details": {
    "strict-transport-security": "max-age=31536000; includeSubDomains; preload",
    "content-security-policy": "Missing",
    "x-frame-options": "DENY",
    "x-content-type-options": "nosniff",
    "referrer-policy": "no-referrer-when-downgrade"
  }
}

About this endpoint

What it does

Audits the security headers present on the webpage at the given URL and returns a JSON object describing the audit result. The response includes a score, a details object, and booleans indicating whether specific headers were found.

Request Body

Parameter	Type	Mandatory	Description
url	String	Yes	URL of the webpage to extract, audit, or validate content from. Must be an `http` or `https` URI.

Response

Returns a JSON object with a score string, a details object whose values are strings, and boolean flags for the presence of specific security headers.

Parameter	Type	Mandatory	Description
score	String	No	Audit score returned by the service.
details	Object	No	A string-to-string map with audit details.
has_csp	Boolean	No	Whether a Content Security Policy header is present.
has_hsts	Boolean	No	Whether an HSTS header is present.
has_x_content_type	Boolean	No	Whether an `X-Content-Type-Options` header is present.
has_referrer_policy	Boolean	No	Whether a Referrer-Policy header is present.
has_x_frame_options	Boolean	No	Whether an `X-Frame-Options` header is present.

Body

Name

Type

Description

bodyREQUIRED

object

—

Security Headers Audit API

What it does

Quickstart

What you'll get back

About this endpoint

What it does

Request Body

Response

Body

Errors any endpoint can return