/api/headers

Grade any URL's security headers.

8 headers, 0-100 score, A-F grade. Built for compliance dashboards and security audits.

Try it

curl "https://api.sitetrace.it.com/api/headers?url=https://github.com" | jq

{
  "url": "https://github.com",
  "final_url": "https://github.com/",
  "status": 200,
  "score": 90,
  "grade": "A",
  "checks": [
    { "id": "hsts",        "header": "strict-transport-security", "present": true,  "pass": true,  "weight": 15, "value": "max-age=31536000; includeSubdomains; preload" },
    { "id": "csp",         "header": "content-security-policy",   "present": true,  "pass": true,  "weight": 20, "value": "default-src 'none'; ..." },
    { "id": "x_frame",     "header": "x-frame-options",           "present": false, "pass": false, "weight": 10, "value": null },
    /* ... */
  ],
  "all_headers": { /* full response headers */ }
}

What's checked

Header	Weight	What we look for
`strict-transport-security`	15	`max-age=` with at least 8 digits (≈1 year)
`content-security-policy`	20	Present and not empty
`x-frame-options`	10	`DENY` or `SAMEORIGIN`
`x-content-type-options`	10	`nosniff`
`referrer-policy`	5	A non-leaky value (`strict-origin`, `no-referrer`, etc.)
`permissions-policy`	5	Present and not empty
`x-xss-protection`	0	Deprecated; OK if absent
`server`	0	Info only — leaks server version

Grading: 90+ A, 80+ B, 60+ C, 40+ D, below F.

Use it to

Compliance dashboards

Score every domain in your portfolio weekly. Alert owners whose grade drops below B.

Pen-test reports

Drop the per-check array into a report. Each row has the header, the value, the expected behavior, and a pass/fail.

CI checks

Call after every deploy. Fail the build if the score drops below your floor.