Security Headers API
The Security Headers API fetches any public web page from the edge, inspects its HTTP response headers, and returns a single, easy-to-understand security posture report. You get a weighted 0-100 score, an A+ through F letter grade, a clear map of which protective headers are present (with their exact values) and which are missing, plus a prioritized list of recommendations sorted from Critical to Info.
Built for CI pipelines, security dashboards, and pre-launch checklists, the API is 100% edge-native: no third-party scanners, no setup. It follows redirects and reports the final_url separately, bounds every request with a configurable timeout, refuses to scan localhost and private addresses, and returns honest HTTP status codes so you always know exactly what was measured.
Free tier · no credit card · billed on RapidAPI
Key features
- Weighted 0-100 security score with A+ to F grade
- Evaluates HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP and CORP
- Heuristic CSP checks for unsafe-inline, unsafe-eval, and wildcard sources
- Present/missing header map with exact returned values
- Severity-sorted recommendations (Critical to Info)
- Flags information-leak headers like Server and X-Powered-By
- Follows redirects and reports final_url separately
- Configurable upstream timeout and edge-native execution
Perfect for
- Fail CI/CD builds that regress security headers
- Continuous monitoring of a fleet of domains
- Pre-launch security checklists
- Security dashboards and posture reporting
- Vendor and third-party site assessment
- Compliance and audit evidence collection
- Clickjacking and XSS exposure analysis
- Penetration-test reconnaissance and triage
Security Headers API Documentation
Everything you need to integrate — base URL, auth, and copy-paste examples.
The Security Headers API exposes a single GET /v1/scan endpoint. Provide a url query parameter (with or without a scheme) and optionally a timeout_ms, and the API fetches the target, follows redirects, evaluates the response headers, and returns a weighted 0-100 score, an A+..F grade, the present/missing header map, and severity-sorted recommendations.
Base URL
https://edge-apis.e9736.workers.devAuthentication
Authenticate by appending your API key as the apikey query parameter. On RapidAPI, the proxy supplies the key automatically via the X-RapidAPI-Key header.
# Direct (edge gateway) — pass the key as a query param
GET /security-headers/v1/scan?url=https://example.com&apikey=YOUR_KEY
# RapidAPI proxy — headers
{
"X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
"X-RapidAPI-Host": "security-headers-analyzer.p.rapidapi.com"
}Request & response
GET /security-headers/v1/scan?url=https://example.com&apikey=YOUR_KEY HTTP/1.1{
"url": "https://example.com",
"final_url": "https://example.com/",
"status": 200,
"score": 72,
"grade": "C",
"present": {
"Strict-Transport-Security": "max-age=31536000; includeSubDomains; preload",
"X-Content-Type-Options": "nosniff",
"X-Frame-Options": "SAMEORIGIN",
"Referrer-Policy": "strict-origin-when-cross-origin",
"Server": "cloudflare"
},
"missing": [
"Content-Security-Policy",
"Permissions-Policy",
"Cross-Origin-Opener-Policy",
"Cross-Origin-Resource-Policy"
],
"recommendations": [
{
"title": "Add a Content-Security-Policy",
"severity": "High",
"description": "No Content-Security-Policy header was returned. CSP is the strongest defense against cross-site scripting (XSS) and data-injection attacks.",
"header": "Content-Security-Policy"
}
]
}Code examples
curl --request GET \
--url 'https://edge-apis.e9736.workers.dev/security-headers/v1/scan?url=https://example.com&apikey=YOUR_KEY'Endpoints
GET /security-headers/v1/scan
Fetch the target URL, follow redirects, evaluate its HTTP security headers, and return a 0-100 score, A+..F grade, present/missing map, and severity-sorted recommendations.
/security-headers/v1/scan?url=https://example.com&apikey=YOUR_KEYGET /security-headers/health
Liveness probe. Returns a simple OK payload. Not under /v1.
/security-headers/healthScan Parameters
Required Parameters
url- Target page URL. Accepts values with or without a scheme (https:// is assumed when omitted). Must resolve to a valid http(s) URL with a host.
Optional Parameters
timeout_ms- Upstream fetch timeout in milliseconds. Default 10000, clamped to the range 1000..15000.apikey- Your API key, passed as a query parameter (alternative to the RapidAPI proxy). Applied globally by the gateway.
Security Headers API Pricing
Choose the right plan for your scanning needs. All tiers include the full scoring engine, every evaluated header, and complete recommendations.
Basic
- Full scoring engine
- All evaluated headers
- Complete recommendations
Pro
- Full scoring engine
- All evaluated headers
- Overage at $0.50 / 1,000
Ultra
- Full scoring engine
- All evaluated headers
- Overage at $0.30 / 1,000
Need higher volume or a custom SLA?
Talk to us about enterprise rates, dedicated support, and compliance docs.
Frequently asked questions
The analyzer evaluates the eight headers that most affect web security: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, and Cross-Origin-Resource-Policy. HSTS and CSP carry the heaviest weight. It also flags information-leak headers such as Server and X-Powered-By when they reveal software or version details.
Each evaluated header contributes a weighted amount to the total score, with HSTS and CSP weighted most heavily because they have the largest security impact. Present headers are also inspected for quality—for example, a CSP using unsafe-inline or unsafe-eval scores lower than a restrictive one, and an HSTS header without includeSubDomains is only partially credited. The final score maps to an A+ through F letter grade.
No. The url parameter accepts values with or without a scheme—https:// is assumed when it is omitted. The value must resolve to a valid http(s) URL with a host. The API follows redirects during the scan and reports the resolved address separately in the final_url field of the response.
Yes. Use the optional timeout_ms parameter to set the upstream fetch timeout in milliseconds. The default is 10000 (10 seconds), and the value is clamped to the range 1000..15000. If the target cannot be reached within the timeout—due to DNS, TLS, network, or timeout issues—the API returns an HTTP 502 with an explanatory error.
When calling the edge gateway directly, append your API key as the apikey query parameter (for example ?apikey=YOUR_KEY). When using the API through RapidAPI, the proxy supplies the key automatically—you send your X-RapidAPI-Key and X-RapidAPI-Host headers and the gateway enforces authentication globally.
Absolutely. The scan is a single deterministic GET call that returns clean JSON, so it integrates cleanly into build steps and scheduled monitors. A common pattern is to fail a pull request when a site's score drops below a chosen threshold, or to poll a fleet of domains on a schedule to detect header drift. The scoring is deterministic, so the same site returns the same result, making it safe to assert on in automated tests.
No. For safety, the API refuses to scan localhost and private/internal addresses, which prevents server-side request forgery (SSRF) abuse. It is designed to scan public web pages and returns honest HTTP status codes—400 for a missing or invalid url, and 502 when the upstream fetch fails.
Related APIs & tools
Other services that pair well — all on the same key.
DNS Lookup API
Query DNS records with support for all record types and reverse lookups—useful for verifying the domains you scan.
Learn more→Email Deliverability API
Analyze SPF, DKIM, and DMARC records to harden email domain configurations and improve deliverability.
Learn more→Whois API
Retrieve domain registration, ownership, and expiration details for any domain you assess.
Learn more→Every week you build in-house is a week you don't ship product
2,500+ teams already made the switch. Start with a free tier today, or talk to us about your enterprise needs.
For developers
Free tier, no credit card. Integrate your first API in under 30 minutes.
Get API keys freeRead the docsFor teams and enterprise
Custom volumes, SLA guarantees, dedicated support, and compliance documentation.
Talk to salesor email sales@apicodex.io