Security Headers Analyzer API
string · requiredstring · enum · requiredstring · requiredstring · requiredstring · requiredstring · requiredinteger · requiredinteger · min: 0 · max: 100 · requiredstring · enum · requiredstring[] · required
Recommendation
titleShort, human-readable summary of the recommendation.
Example: Add a Content-Security-Policy
severityPriority of the recommendation.
Enum values:
Critical
High
Medium
Low
Info
Example: High
descriptionExplanation of why this matters and how to fix it.
Example: No Content-Security-Policy header was returned. CSP is the strongest defense against cross-site scripting (XSS) and data-injection attacks.
headerThe HTTP header the recommendation concerns.
Example: Content-Security-Policy
ScanResult
urlThe normalized requested URL.
Example: https://example.com
final_urlThe URL after following redirects.
Example: https://example.com/
statusHTTP status code of the final response.
Example: 200
scoreWeighted security score.
Example: 72
gradeLetter grade derived from the score.
Enum values:
A+
A
B
C
D
F
Example: C
object · required
Canonical header name -> returned value for headers that were present.
Example: {"Strict-Transport-Security":"max-age=31536000; includeSubDomains; preload","X-Content-Type-Options":"nosniff","X-Frame-Options":"SAMEORIGIN"}
missingCanonical names of evaluated headers that were absent.
Example: ["Content-Security-Policy","Permissions-Policy"]
Recommendation[] · required
Severity-sorted list of remediation guidance.