Security headers API API

Example request

curl -H "X-API-Key: $DOMSCAN_API_KEY" "https://domscan.net/v1/headers?url=https%3A%2F%2Fexample.com&domain=example.com"

const response = await fetch("https://domscan.net/v1/headers?url=https%3A%2F%2Fexample.com&domain=example.com", {
  headers: { "X-API-Key": process.env.DOMSCAN_API_KEY },
});
const data = await response.json();
console.log(data);

import os
import requests

response = requests.get(
    "https://domscan.net/v1/headers?url=https%3A%2F%2Fexample.com&domain=example.com",
    headers={"X-API-Key": os.environ["DOMSCAN_API_KEY"]},
)
print(response.json())

package main

import (
	"fmt"
	"io"
	"net/http"
	"os"
)

func main() {
	req, err := http.NewRequest(http.MethodGet, "https://domscan.net/v1/headers?url=https%3A%2F%2Fexample.com&domain=example.com", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("X-API-Key", os.Getenv("DOMSCAN_API_KEY"))

	resp, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer resp.Body.Close()

	data, err := io.ReadAll(resp.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(resp.Status, string(data))
}

require "json"
require "net/http"

uri = URI("https://domscan.net/v1/headers?url=https%3A%2F%2Fexample.com&domain=example.com")
request = Net::HTTP::Get.new(uri)
request["X-API-Key"] = ENV.fetch("DOMSCAN_API_KEY")

response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |http|
  http.request(request)
end
puts JSON.pretty_generate(JSON.parse(response.body))

Example response

{
  "url": "https://example.com/",
  "domain": "example.com",
  "status": "ok",
  "checked_at": "2026-10-09T10:15:30.000Z",
  "final_url": "https://www.example.com/",
  "http_status": 200,
  "redirect_count": 1,
  "https": true,
  "score": 75,
  "grade": "C",
  "summary": {
    "passed": 6,
    "warned": 2,
    "failed": 0,
    "missing": 2,
    "not_applicable": 1,
    "hsts_preload_ready": false,
    "csp_strict": false
  },
  "checks": [
    {
      "id": "strict_transport_security",
      "status": "pass",
      "value": "max-age=31536000",
      "detail_code": "enabled",
      "issues": [
        "include_subdomains_missing",
        "preload_missing"
      ],
      "weight": 20
    },
    {
      "id": "content_security_policy",
      "status": "warn",
      "value": "default-src 'self'; script-src 'self' 'unsafe-inline'",
      "detail_code": "unsafe_inline",
      "issues": [
        "missing_object_src",
        "missing_base_uri",
        "unsafe_inline"
      ],
      "weight": 25
    },
    {
      "id": "clickjacking",
      "status": "pass",
      "value": "SAMEORIGIN",
      "detail_code": "x_frame_options_sameorigin",
      "issues": [],
      "weight": 10
    },
    {
      "id": "x_content_type_options",
      "status": "pass",
      "value": "nosniff",
      "detail_code": "nosniff",
      "issues": [],
      "weight": 10
    },
    {
      "id": "referrer_policy",
      "status": "pass",
      "value": "strict-origin-when-cross-origin",
      "detail_code": "strict_origin_when_cross_origin",
      "issues": [],
      "weight": 10
    },
    {
      "id": "permissions_policy",
      "status": "missing",
      "value": null,
      "detail_code": "header_missing",
      "issues": [],
      "weight": 5
    },
    {
      "id": "cross_origin_opener_policy",
      "status": "pass",
      "value": "same-origin",
      "detail_code": "same_origin",
      "issues": [],
      "weight": 5
    },
    {
      "id": "cross_origin_embedder_policy",
      "status": "not_applicable",
      "value": null,
      "detail_code": "not_set_informational",
      "issues": [],
      "weight": 0
    },
    {
      "id": "cross_origin_resource_policy",
      "status": "missing",
      "value": null,
      "detail_code": "header_missing",
      "issues": [],
      "weight": 5
    },
    {
      "id": "information_disclosure",
      "status": "warn",
      "value": "server: nginx/1.25.3",
      "detail_code": "version_disclosed",
      "issues": [
        "server_version_disclosed"
      ],
      "weight": 5
    },
    {
      "id": "cookies",
      "status": "pass",
      "value": "session",
      "detail_code": "all_flags_set",
      "issues": [],
      "weight": 5
    }
  ],
  "cookies": [
    {
      "name": "session",
      "secure": true,
      "http_only": true,
      "same_site": "lax",
      "issues": []
    }
  ],
  "headers_raw": {
    "strict-transport-security": "max-age=31536000",
    "content-security-policy": "default-src 'self'; script-src 'self' 'unsafe-inline'",
    "x-frame-options": "SAMEORIGIN",
    "x-content-type-options": "nosniff",
    "referrer-policy": "strict-origin-when-cross-origin",
    "cross-origin-opener-policy": "same-origin",
    "server": "nginx/1.25.3"
  },
  "recommendations": [
    "remove_csp_unsafe_inline",
    "add_csp_object_src_none",
    "add_csp_base_uri",
    "add_hsts_include_subdomains",
    "add_hsts_preload",
    "add_permissions_policy",
    "add_cross_origin_resource_policy",
    "hide_server_version"
  ],
  "fetch": {
    "checked_url": "https://example.com/",
    "http_status": 200,
    "final_url": "https://www.example.com/",
    "via_proxy": true,
    "redirect_count": 1,
    "unknown_reason": null
  },
  "caveats": [
    "set_cookie_visibility_limited",
    "meta_csp_not_evaluated"
  ],
  "rubric_version": "2026-10-09.1"
}

HTTP status codes

• 200 OK
• 400 Bad Request
• 401 Unauthorized
• 402 Payment Required
• 429 Too Many Requests
• 502 Bad Gateway