Website Security Headers — audit header coverage

Security Header Full Audit API

What it does

Website Security Headers audits a site’s HTTP security headers and returns a simple score, the URL checked, and practical recommendations. Send a URL in the request body and get back the header status for common protections, including csp, hsts, and x_frame_options.

Use it when you want a quick security baseline for a production site, a staging environment, or a customer-facing landing page. The response tells you which headers are present or missing, so you can spot gaps that affect browser-side protection and harden your deployment without manual inspection.

The output is easy to use in internal dashboards, CI checks, or security review workflows. The recommendations array gives you concrete next steps, such as adding a Content-Security-Policy header, while the score helps you compare sites or track improvements over time.

If you need a lightweight check for common web hardening headers, Website Security Headers gives you the core signal in one response.

What you'll get back

Returns a JSON object with url as a string, score as an integer, recommendations as an array of strings, and security_headers as an object.

{
  "url": "example.com",
  "score": 67,
  "recommendations": ["Add Content-Security-Policy header"],
  "security_headers": {
    "csp": "missing",
    "hsts": "present",
    "x_frame_options": "present"
  }
}

About this endpoint

What it does

Audits the security headers for a website URL and returns the URL, an overall score, recommendations, and a breakdown of specific security header checks.

Request Body

Parameter	Type	Mandatory	Description
url	String	Yes	The website URL to audit.

Response

Returns a JSON object with url as a string, score as an integer, recommendations as a string array, and security_headers as an object. The security_headers object includes csp, hsts, and x_frame_options string fields.

Parameter	Type	Mandatory	Description
url	String	No	The audited website URL.
score	Integer	No	The audit score.
recommendations	String Array	No	A list of recommendations for improving the website's security headers.
security_headers	Object	No	The security header check results.
security_headers.csp	String	No	Content Security Policy header status.
security_headers.hsts	String	No	HTTP Strict Transport Security header status.
security_headers.x_frame_options	String	No	X-Frame-Options header status.

Body

Name

Type

Description

bodyREQUIRED

object

—

Security Header Full Audit API

What it does

Quickstart

What you'll get back

About this endpoint

What it does

Request Body

Response

Body

Errors any endpoint can return