How is the 0-100 score calculated?

Each evaluated header contributes a weighted amount to the total score, with HSTS and CSP weighted most heavily because they have the largest security impact. Present headers are also inspected for quality—for example, a CSP using unsafe-inline or unsafe-eval scores lower than a restrictive one, and an HSTS header without includeSubDomains is only partially credited. The final score maps to an A+ through F letter grade.

Do I need to include the scheme (https://) in the url parameter?

No. The url parameter accepts values with or without a scheme—https:// is assumed when it is omitted. The value must resolve to a valid http(s) URL with a host. The API follows redirects during the scan and reports the resolved address separately in the final_url field of the response.

Can I control how long a scan waits for the target?

Yes. Use the optional timeout_ms parameter to set the upstream fetch timeout in milliseconds. The default is 10000 (10 seconds), and the value is clamped to the range 1000..15000. If the target cannot be reached due to DNS, TLS or network issues, the API returns an HTTP 502 with an explanatory error; if it does not answer within the timeout, it returns an HTTP 504.

How do I authenticate my requests?

Append your API key as the apikey query parameter (for example ?apikey=YOUR_KEY), or send it in an X-Api-Key header. Either way the gateway enforces authentication globally, and requests refused for bad input (4xx) consume no credits.

Is the API suitable for CI/CD pipelines and continuous monitoring?

Absolutely. The scan is a single deterministic GET call that returns clean JSON, so it integrates cleanly into build steps and scheduled monitors. A common pattern is to fail a pull request when a site's score drops below a chosen threshold, or to poll a fleet of domains on a schedule to detect header drift. The scoring is deterministic, so the same site returns the same result, making it safe to assert on in automated tests.

Will the API scan internal or private addresses?

No. For safety, the API refuses to scan localhost and private/internal addresses, which prevents server-side request forgery (SSRF) abuse. It is designed to scan public web pages and returns honest HTTP status codes—400 for a missing or invalid url, and 502 when the upstream fetch fails.

Instant HTTP security-header scoring, grading, and remediation for any URL

Security Headers API

The Security Headers API fetches any public web page from the edge, inspects its HTTP response headers, and returns a single, easy-to-understand security posture report. You get a weighted 0-100 score, an A+ through F letter grade, a clear map of which protective headers are present (with their exact values) and which are missing, plus a prioritized list of recommendations sorted from Critical to Info.

Built for CI pipelines, security dashboards, and pre-launch checklists, the API is 100% edge-native: no third-party scanners, no setup. It follows redirects and reports the final_url separately, bounds every request with a configurable timeout, refuses to scan localhost and private addresses, and returns honest HTTP status codes so you always know exactly what was measured.

Get a free API key Read the docs

Free tier included, no credit card required. One key works across every API.

Free calls / month: 200
Headers Evaluated: 8+
Scan Speed: <300ms
Uptime SLA: 99.9%

Get your free API key

200 free calls on the free plan

Key features

Weighted 0-100 security score with A+ to F grade
Evaluates HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP and CORP
Heuristic CSP checks for unsafe-inline, unsafe-eval, and wildcard sources
Present/missing header map with exact returned values
Severity-sorted recommendations (Critical to Info)
Flags information-leak headers like Server and X-Powered-By
Follows redirects and reports final_url separately
Configurable upstream timeout and edge-native execution

Built for

Fail CI/CD builds that regress security headers
Continuous monitoring of a fleet of domains
Pre-launch security checklists
Security dashboards and posture reporting
Vendor and third-party site assessment
Compliance and audit evidence collection
Clickjacking and XSS exposure analysis
Penetration-test reconnaissance and triage

MCP · for your agent

Hand the Security Headers API to your agent

Connect Claude, Cursor or any MCP client once, then ask in plain words. Your agent finds this API, reads its docs and makes the call: 5 credits per call, the same as REST, from your team's balance.

Connect your agent

Run a pre-launch security check

“We launch app.example.com on Monday. Scan its security headers and give me the fixes in priority order.”

list_apis · get_api_docsfree

api_request GET /security-headers/v1/scan?url=https://app.example.com 5 cr

A 0-100 score and letter grade, the missing headers, and fixes ranked by severity.

Assess a vendor's web security

“For our vendor review, grade Fabrikam's website security headers and their email domain's SPF and DMARC setup.”

list_apis · get_api_docsfree

api_request GET /security-headers/v1/scan?url=https://www.fabrikam.com 5 cr

+ Email Deliverability API5 cr

Header grade and missing protections, plus email-authentication status, for the risk file.

Catch header regressions after deploys

“After today's deploy, did example.com lose any security headers? Last week it scored an A.”

list_apis · get_api_docsfree

api_request GET /security-headers/v1/scan?url=https://example.com 5 cr

Today's grade and header map, with anything missing since last week's A called out.

$ claude mcp add --transport http apicodex https://mcp.apicodex.io

Illustrative asks; the calls and prices are real. Claude, Cursor, VS Code and Windsurf setup: mcp.apicodex.io

Try it

Build the request for your data

Edit the parameters below and see the exact request and curl command you'd send. No key required to preview.

GET /security-headers/v1/scan

Open in Playground

Parameters

url

apikey

Request · HTTP

GET /security-headers/v1/scan?url=https://example.com&apikey=YOUR_KEY HTTP/1.1
Host: api.apicodex.io

Response · JSON 200 OK

{
"url": "https://example.com",
"final_url": "https://example.com/",
"status": 200,
"score": 72,
"grade": "C",
"present": {
  "Strict-Transport-Security": "max-age=31536000; includeSubDomains; preload",
  "X-Content-Type-Options": "nosniff",
  "X-Frame-Options": "SAMEORIGIN",
  "Referrer-Policy": "strict-origin-when-cross-origin",
  "Server": "cloudflare"
},
"missing": [
  "Content-Security-Policy",
  "Permissions-Policy",
  "Cross-Origin-Opener-Policy",
  "Cross-Origin-Resource-Policy"
],
"recommendations": [
  {
    "title": "Add a Content-Security-Policy",
    "severity": "High",
    "description": "No Content-Security-Policy header was returned. CSP is the strongest defense against cross-site scripting (XSS) and data-injection attacks.",
    "header": "Content-Security-Policy"
  }
]
}

Run it with your key

Documentation

Security Headers API Documentation

The Security Headers API exposes a single GET /v1/scan endpoint. Provide a url query parameter (with or without a scheme) and optionally a timeout_ms, and the API fetches the target, follows redirects, evaluates the response headers, and returns a weighted 0-100 score, an A+..F grade, the present/missing header map, and severity-sorted recommendations.

Base URL

url

https://api.apicodex.io/security-headers

Authentication

Authenticate by appending your API key as the apikey query parameter, or by sending it in an X-Api-Key header.

headers

# Query parameter
GET /security-headers/v1/scan?url=https://example.com&apikey=YOUR_KEY

# Header
{
"X-Api-Key": "YOUR_API_KEY"
}

Request and response

Illustrative values. Confirm current endpoint behavior, quotas, and data freshness in the API documentation before production use.

request · http

GET /security-headers/v1/scan?url=https://example.com&apikey=YOUR_KEY HTTP/1.1
Host: api.apicodex.io

response · json

{
"url": "https://example.com",
"final_url": "https://example.com/",
"status": 200,
"score": 72,
"grade": "C",
"present": {
  "Strict-Transport-Security": "max-age=31536000; includeSubDomains; preload",
  "X-Content-Type-Options": "nosniff",
  "X-Frame-Options": "SAMEORIGIN",
  "Referrer-Policy": "strict-origin-when-cross-origin",
  "Server": "cloudflare"
},
"missing": [
  "Content-Security-Policy",
  "Permissions-Policy",
  "Cross-Origin-Opener-Policy",
  "Cross-Origin-Resource-Policy"
],
"recommendations": [
  {
    "title": "Add a Content-Security-Policy",
    "severity": "High",
    "description": "No Content-Security-Policy header was returned. CSP is the strongest defense against cross-site scripting (XSS) and data-injection attacks.",
    "header": "Content-Security-Policy"
  }
]
}

Code examples

cURL

curl --request GET \
  --url 'https://api.apicodex.io/security-headers/v1/scan?url=https://example.com&apikey=YOUR_KEY'

JavaScript/Node.js

const params = new URLSearchParams({
  url: 'https://example.com',
  apikey: 'YOUR_KEY'
});

const response = await fetch(
  `https://api.apicodex.io/security-headers/v1/scan?${params}`
);

const data = await response.json();
console.log(`Score: ${data.score} (${data.grade})`);
console.log('Missing headers:', data.missing);

Python

import requests

url = "https://api.apicodex.io/security-headers/v1/scan"

querystring = {"url": "https://example.com", "apikey": "YOUR_KEY"}

response = requests.get(url, params=querystring)
data = response.json()

print(f"Score: {data['score']} ({data['grade']})")
print("Missing headers:", data["missing"])

Endpoints

GET /v1/scan

Fetch the target URL, follow redirects, evaluate its HTTP security headers, and return a 0-100 score, A+..F grade, present/missing map, and severity-sorted recommendations.

/v1/scan?url=https://example.com&apikey=YOUR_KEY

Scan Parameters

Required parameters

url Target page URL. Accepts values with or without a scheme (https:// is assumed when omitted). Must resolve to a valid http(s) URL with a host.

Optional parameters

timeout_ms Upstream fetch timeout in milliseconds. Default 10000, clamped to the range 1000..15000.
apikey Your API key, passed as a query parameter. An X-Api-Key header works too. Applied globally by the gateway.

Pricing

Security Headers API Pricing

This API costs 5 credits per request. Credits are shared across every API on your plan.

Estimate your monthly cost

Drag the slider to match your expected request volume. We'll recommend the cheapest plan that covers it.

Requests per month 10,000

Recommended plan

Starter

$29.99 /month

Credits used

Credits included

Cost per 1K requests

Choose Starter

Free

1,000 credits · ~200 requests/mo · 2 rps

All APIs included
No credit card required
Full documentation and examples
MCP server for your AI agents
Up to 5 active API keys

Start for free

Starter

Popular

$29.99 /month

50,000 credits · ~10,000 requests/mo · 10 rps

All APIs included
Email support
Usage dashboard and analytics
MCP server for your AI agents
Up to 5 active API keys

Start with Starter

Pro

$99.99 /month

250,000 credits · ~50,000 requests/mo · 25 rps

All APIs included
Priority support
MCP server for your AI agents
Up to 5 active API keys

Start with Pro

FAQ

Security Headers API

Key features

Built for

Hand the Security Headers API to your agent

Run a pre-launch security check

Assess a vendor's web security

Catch header regressions after deploys

Build the request for your data

Security Headers API Documentation

Base URL

Authentication

Request and response

Code examples

Endpoints

GET /v1/scan

Scan Parameters

Required parameters

Optional parameters

Security Headers API Pricing

Free

Starter

Pro

Need a different plan?

Frequently asked questions

Related APIs