Free Security Headers API - Check Headers

Parameters

name	in	type	required	description
`url`	query	string	required	Url

Request

Send your key in the X-API-Key header. More languages and patterns live on the code examples page.

curl -s "https://apixies.io/api/v1/inspect-headers?url=https%3A%2F%2Fgithub.com" \
  -H "X-API-Key: YOUR_API_KEY"

const res = await fetch("https://apixies.io/api/v1/inspect-headers?url=https%3A%2F%2Fgithub.com", {
  headers: { "X-API-Key": "YOUR_API_KEY" }
});
const data = await res.json();
console.log(data);

$ch = curl_init("https://apixies.io/api/v1/inspect-headers?url=https%3A%2F%2Fgithub.com");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => ["X-API-Key: YOUR_API_KEY"],
]);
$data = json_decode(curl_exec($ch), true);
curl_close($ch);

print_r($data);

import requests

res = requests.get(
    "https://apixies.io/api/v1/inspect-headers",
    params={"url": "https://github.com"},
    headers={"X-API-Key": "YOUR_API_KEY"},
)
print(res.json())

Response

The result sits under data in the standard envelope. See the response format guide for errors and status codes.

returns

data.grade: Letter grade based on how many security headers are missing.
data.missing: Recommended security headers the site doesn't send.
data.headers: Every response header, keyed by lowercase name.
data.status_code: HTTP status the URL answered with.
data.url: The URL that was scanned.

example response 200

{
    "status": "success",
    "http_code": 200,
    "code": "SUCCESS",
    "message": "Security headers inspected successfully.",
    "data": {
        "url": "https://github.com",
        "status_code": 200,
        "headers": {
            "date": "Fri, 18 Sep 2026 12:00:00 GMT",
            "content-type": "text/html; charset=utf-8",
            "server": "github.com",
            "strict-transport-security": "max-age=31536000; includeSubdomains; preload",
            "x-frame-options": "deny",
            "x-content-type-options": "nosniff",
            "x-xss-protection": "0",
            "referrer-policy": "origin-when-cross-origin, strict-origin-when-cross-origin",
            "content-security-policy": "default-src 'none'; base-uri 'self'; frame-ancestors 'none'; upgrade-insecure-requests"
        },
        "missing": [
            "permissions-policy",
            "cross-origin-embedder-policy",
            "cross-origin-opener-policy",
            "cross-origin-resource-policy"
        ],
        "grade": "B",
        "scanned_at": "2026-09-18T12:00:00+00:00"
    }
}

Authentication and limits

This endpoint needs an API key. Use the sandbox ("try it" above) to test it without registering. See the authentication guide for details.

Standard rate limits apply to this endpoint.

Common use cases

Security compliance auditing

Automatically scan your web properties for missing security headers like HSTS, CSP, and X-Frame-Options. Generate compliance reports for security reviews.

Competitive security analysis

Compare your site's security header configuration against competitors. Identify gaps and prioritize header implementations.

CI/CD security gate

Add a security headers check to your deployment pipeline. Block releases that remove critical security headers from staging or production environments.

related endpoints

GET SSL Health Inspector Inspect SSL certificate details for a domain, including validity, expiry and chain health GET Redirect Tracer Follow a URL's redirect chain and report each hop with status code GET Meta Tag Extractor Extract OpenGraph, Twitter Card, and standard meta tags from any URL

getting started

authentication code examples response format

explore

all api endpoints guides and tutorials online tools

resources

homepage changelog suggest an endpoint

Get a free API key

A temporary key takes one click and no signup. Register and you get 75 requests/day. Free tier is for development & small projects.

get a temporary key create an account