Security Headers Checker API

Check the HTTP security headers of any website (HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy...) with a score, a grade and fixes to apply.

Authentication & base URL

Subscribe through one of our marketplace listings; your marketplace API key and base URL are shown there. All endpoints return JSON over HTTPS, served from a global edge network (typically 20–150 ms).

Subscribe on RapidAPI

Endpoints

GET `/v1/security-headers`

Check security headers

Parameter	In	Description	Example
`url` *	query	Website URL	`https://github.com`

Example

GET /v1/security-headers?url=https%3A%2F%2Fgithub.com

{
  "url": "https://github.com/",
  "finalUrl": "https://github.com/",
  "status": 200,
  "https": true,
  "score": 75,
  "grade": "A",
  "present": {
    "strict-transport-security": "max-age=31536000; includeSubdomains; preload",
    "content-security-policy": "default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com github.githubassets.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net productionresultssa1.blob.core.windows.net productionresultssa2.blob.core.windows.net productionresultssa3.blob.core.windows.net productionresultssa4.blob.core.windows.net productionresultssa5.blob.core.windows.net productionresultssa6.blob.core.windows.net productionresultssa7.blob.core.windows.net productionresultssa8.blob.core.windows.net productionresultssa9.blob.core.windows.net productionresultssa10.blob.core.windows.net productionresultssa11.blob.core.windows.net productionresultssa12.blob.core.windows.net productionresultssa13.blob.core.windows.net productionresultssa14.blob.core.windows.net productionresultssa15.blob.core.windows.net productionresultssa16.blob.core.windows.net productionresultssa17.blob.core.windows.net productionresultssa18.blob.core.windows.net productionresultssa19.blob.core.windows.net github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com wss://alive-staging.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com wss://production-copilot-host.webpubsub.azure.com api.github.com/cmc_internal/api/ edge.fullstory.com rs.fullstory.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com www.youtube-nocookie.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com release-assets.githubusercontent.com secured-user-images.githubusercontent.com user-images.githubusercontent.com private-user-images.githubusercontent.com opengraph.githubassets.com repository-images.githubusercontent.com marketplace-screenshots.githubusercontent.com copilotprodattachments.blob.core.windows.net/github-production-copilot-attachments/ github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com explore-feed.github.com *.googleusercontent.com objects-origin.githubusercontent.com *.githubusercontent.com images.ctfassets.net/8aevphvgewt8/; manifest-src 'self'; media-src github.com user-images.githubusercontent.com secured-user-images.githubusercontent.com private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com github.githubassets.com assets.ctfassets.net/8aevphvgewt8/ videos.ctfassets.net/8aevphvgewt8/; script-src github.githubassets.com 'sha256-tSjmyPUky1KbRZ0fw9VUil3wFEbeM82rtbJDygGJAXw='; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/assets-cdn/worker/",
    "x-frame-options": "deny",
    "x-content-type-options": "nosniff",
    "referrer-policy": "origin-when-cross-origin, strict-origin-when-cross-origin"
  },
  "missing": [
    "permissions-policy",
    "cross-origin-opener-policy",
    "cross-origin-resource-policy",
    "cross-origin-embedder-policy"
  ],
  "informationLeaks": [
    {
      "header": "server",
      "value": "cloudflare"
    }
  ],
  "advice": [
    "Add the permissions-policy header",
    "Add the cross-origin-opener-policy header",
    "Add the cross-origin-resource-policy header",
    "Add the cross-origin-embedder-policy header"
  ]
}

Check the HTTP security headers of any website (HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy...) with a score, a grade and fixes to apply.

Use cases

Security audits, compliance reports, agency site checks, CI/CD gates, monitoring client websites.

Why this API

Fast: runs on a global edge network, typical response well under 1 second.
Reliable: simple JSON, clear error messages.
Fair pricing: Free plan 500 requests/month, Pro 25,000 for $4.99, Ultra 150,000 for $14.99.

Pricing

Free plan with 500 calls per month, then Pro (25,000 calls for $4.99/month) and Ultra (150,000 calls for $14.99/month). See all plans.