Website Security Header Audit — score and fix headers

Security Header Full Audit API

What it does

Website Security Header Audit checks a URL and returns a score, a header-by-header summary, and recommendations for fixing missing or weak browser security controls.

Send a website URL in the request body. The service evaluates the site and responds with the URL, an integer score, a security_headers object, and a recommendations array of strings. The header summary includes csp, hsts, and x_frame_options, with values such as present or missing so you can see which protections are in place at a glance.

Use it when you need to audit production sites, gate a release, or track security hardening across a portfolio of domains. It is useful for CI checks, compliance reviews, and lightweight security monitoring where you want a quick verdict instead of a full browser-based scan.

The response is intentionally compact, making it easy to store, compare over time, or surface in internal dashboards. If a site is missing important headers, the recommendations list points to the next remediation step, such as adding a Content-Security-Policy header.

{ "url": "example.com", "score": 67, "recommendations": ["Add Content-Security-Policy header"], "security_headers": { "csp": "missing", "hsts": "present", "x_frame_options": "present" } }

About this endpoint

What it does

Audits a website’s security headers for the URL you provide in the request body and returns a JSON object with the audit results for that URL. The response includes the scanned url, an integer score, a list of recommendations, and a security_headers object with the detected header statuses.

Request Body

Parameter	Type	Mandatory	Description
url	String	Yes	The website URL or hostname to audit.

Response

Returns a JSON object with url as a string, score as an integer, recommendations as a string array, and security_headers as an object. The security_headers object contains csp, hsts, and x_frame_options string fields.

Parameter	Type	Mandatory	Description
url	String	No	The website URL that was audited.
score	Integer	No	The audit score returned by the service.
recommendations	String Array	No	A list of recommendation strings for improving the website’s security headers.
security_headers	Object	No	The detected security header statuses.
security_headers.csp	String	No	The status of the Content-Security-Policy header.
security_headers.hsts	String	No	The status of the Strict-Transport-Security header.
security_headers.x_frame_options	String	No	The status of the X-Frame-Options header.

Body

Name

Type

Description

bodyREQUIRED

object

—

Security Header Full Audit API

What it does

QUICKSTART

Quickstart

What you'll get back

About this endpoint

What it does

Request Body

Response

Body

Errors any endpoint can return