Instant HTTP security-header scoring, grading, and remediation for any URL
Security Headers API
The Security Headers API fetches any public web page from the edge, inspects its HTTP response headers, and returns a single, easy-to-understand security posture report. You get a weighted 0-100 score, an A+ through F letter grade, a clear map of which protective headers are present (with their exact values) and which are missing, plus a prioritized list of recommendations sorted from Critical to Info.
Built for CI pipelines, security dashboards, and pre-launch checklists, the API is 100% edge-native: no third-party scanners, no setup. It follows redirects and reports the final_url separately, bounds every request with a configurable timeout, refuses to scan localhost and private addresses, and returns honest HTTP status codes so you always know exactly what was measured.
Free tier included, no credit card required. One key works across all 49 APIs.
- Headers Evaluated
- 8+
- Scan Speed
- <300ms
- Uptime SLA
- 99.9%
Key features
- Weighted 0-100 security score with A+ to F grade
- Evaluates HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP and CORP
- Heuristic CSP checks for unsafe-inline, unsafe-eval, and wildcard sources
- Present/missing header map with exact returned values
- Severity-sorted recommendations (Critical to Info)
- Flags information-leak headers like Server and X-Powered-By
- Follows redirects and reports final_url separately
- Configurable upstream timeout and edge-native execution
Built for
- Fail CI/CD builds that regress security headers
- Continuous monitoring of a fleet of domains
- Pre-launch security checklists
- Security dashboards and posture reporting
- Vendor and third-party site assessment
- Compliance and audit evidence collection
- Clickjacking and XSS exposure analysis
- Penetration-test reconnaissance and triage
Try it
Build the request for your data
Edit the parameters below and see the exact curl command and JSON response you will get. No key required to preview.
Parameters
GET /security-headers/v1/scan?url=https%3A%2F%2Fexample.com&apikey=YOUR_KEY HTTP/1.1
Host: api.apicodex.io
{
"url": "https://example.com",
"final_url": "https://example.com/",
"status": 200,
"score": 72,
"grade": "C",
"present": {
"Strict-Transport-Security": "max-age=31536000; includeSubDomains; preload",
"X-Content-Type-Options": "nosniff",
"X-Frame-Options": "SAMEORIGIN",
"Referrer-Policy": "strict-origin-when-cross-origin",
"Server": "cloudflare"
},
"missing": [
"Content-Security-Policy",
"Permissions-Policy",
"Cross-Origin-Opener-Policy",
"Cross-Origin-Resource-Policy"
],
"recommendations": [
{
"title": "Add a Content-Security-Policy",
"severity": "High",
"description": "No Content-Security-Policy header was returned. CSP is the strongest defense against cross-site scripting (XSS) and data-injection attacks.",
"header": "Content-Security-Policy"
}
]
}Documentation
Security Headers API Documentation
The Security Headers API exposes a single GET /v1/scan endpoint. Provide a url query parameter (with or without a scheme) and optionally a timeout_ms, and the API fetches the target, follows redirects, evaluates the response headers, and returns a weighted 0-100 score, an A+..F grade, the present/missing header map, and severity-sorted recommendations.
Base URL
https://api.apicodex.ioAuthentication
Authenticate by appending your API key as the apikey query parameter, or by sending it in an X-Api-Key header.
# Query parameter
GET /security-headers/v1/scan?url=https://example.com&apikey=YOUR_KEY
# Header
{
"X-Api-Key": "YOUR_API_KEY"
}Request and response
Illustrative values. Confirm current endpoint behavior, quotas, and data freshness in the API documentation before production use.
GET /security-headers/v1/scan?url=https://example.com&apikey=YOUR_KEY HTTP/1.1{
"url": "https://example.com",
"final_url": "https://example.com/",
"status": 200,
"score": 72,
"grade": "C",
"present": {
"Strict-Transport-Security": "max-age=31536000; includeSubDomains; preload",
"X-Content-Type-Options": "nosniff",
"X-Frame-Options": "SAMEORIGIN",
"Referrer-Policy": "strict-origin-when-cross-origin",
"Server": "cloudflare"
},
"missing": [
"Content-Security-Policy",
"Permissions-Policy",
"Cross-Origin-Opener-Policy",
"Cross-Origin-Resource-Policy"
],
"recommendations": [
{
"title": "Add a Content-Security-Policy",
"severity": "High",
"description": "No Content-Security-Policy header was returned. CSP is the strongest defense against cross-site scripting (XSS) and data-injection attacks.",
"header": "Content-Security-Policy"
}
]
}Code examples
curl --request GET \
--url 'https://api.apicodex.io/security-headers/v1/scan?url=https://example.com&apikey=YOUR_KEY'Endpoints
GET /security-headers/v1/scan
Fetch the target URL, follow redirects, evaluate its HTTP security headers, and return a 0-100 score, A+..F grade, present/missing map, and severity-sorted recommendations.
/security-headers/v1/scan?url=https://example.com&apikey=YOUR_KEYGET /security-headers/health
Liveness probe. Returns a simple OK payload. Not under /v1.
/security-headers/healthScan Parameters
Required parameters
urlTarget page URL. Accepts values with or without a scheme (https:// is assumed when omitted). Must resolve to a valid http(s) URL with a host.
Optional parameters
timeout_msUpstream fetch timeout in milliseconds. Default 10000, clamped to the range 1000..15000.apikeyYour API key, passed as a query parameter. An X-Api-Key header works too. Applied globally by the gateway.
Pricing
Security Headers API Pricing
One key, one subscription, all 49 APIs. Start free and upgrade when you grow. No minimums, no lock-in.
This API costs 5 credits per request. Credits are shared across every API on your plan.
Estimate your monthly cost
Drag the slider to match your expected request volume. We will recommend the cheapest plan that covers it.
Recommended plan
Starter
$29.99 /month
Free
- All 49 APIs included
- No credit card required
- Full documentation and examples
Starter
Popular- All 49 APIs included
- Email support
- Usage dashboard and analytics
Pro
- All 49 APIs included
- Priority support
- Up to 5 API keys
Need a different plan?
Tell us about your API, volume, or support requirements.
Coming soon · MCP
Use the Security Headers API from your AI agent
The API Codex MCP server will expose this API, and the other 39, to Claude, Cursor and any MCP client as tools. Same key, same credits, one config entry.
FAQ
Frequently asked questions
The analyzer evaluates the eight headers that most affect web security: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, and Cross-Origin-Resource-Policy. HSTS and CSP carry the heaviest weight. It also flags information-leak headers such as Server and X-Powered-By when they reveal software or version details.
Each evaluated header contributes a weighted amount to the total score, with HSTS and CSP weighted most heavily because they have the largest security impact. Present headers are also inspected for quality—for example, a CSP using unsafe-inline or unsafe-eval scores lower than a restrictive one, and an HSTS header without includeSubDomains is only partially credited. The final score maps to an A+ through F letter grade.
No. The url parameter accepts values with or without a scheme—https:// is assumed when it is omitted. The value must resolve to a valid http(s) URL with a host. The API follows redirects during the scan and reports the resolved address separately in the final_url field of the response.
Yes. Use the optional timeout_ms parameter to set the upstream fetch timeout in milliseconds. The default is 10000 (10 seconds), and the value is clamped to the range 1000..15000. If the target cannot be reached within the timeout—due to DNS, TLS, network, or timeout issues—the API returns an HTTP 502 with an explanatory error.
Append your API key as the apikey query parameter (for example ?apikey=YOUR_KEY), or send it in an X-Api-Key header. Either way the gateway enforces authentication globally, and only successful responses consume credits.
Absolutely. The scan is a single deterministic GET call that returns clean JSON, so it integrates cleanly into build steps and scheduled monitors. A common pattern is to fail a pull request when a site's score drops below a chosen threshold, or to poll a fleet of domains on a schedule to detect header drift. The scoring is deterministic, so the same site returns the same result, making it safe to assert on in automated tests.
No. For safety, the API refuses to scan localhost and private/internal addresses, which prevents server-side request forgery (SSRF) abuse. It is designed to scan public web pages and returns honest HTTP status codes—400 for a missing or invalid url, and 502 when the upstream fetch fails.
Keep building
Related APIs
Query DNS records with support for all record types and reverse lookups—useful for verifying the domains you scan.
Analyze SPF, DKIM, and DMARC records to harden email domain configurations and improve deliverability.
Retrieve domain registration, ownership, and expiration details for any domain you assess.