HTTP security header audit for any URL

HTTP security header audit for any URL - HSTS, CSP, clickjacking, referrer policy, cookies and a letter grade

Paid test badge: not yet. The checks above are free: we call the tool without paying and read the payment request it sends back. The Verified badge needs paid calls whose answers match the promised output, and nobody can buy a badge.

Endpoint

GET https://saylorinnovations.com/api/audit/headers

Our checks, last 30 days

Example input (from the provider)

{
  "method": "GET",
  "queryParams": {
    "url": "https://saylorinnovations.com"
  },
  "type": "http"
}

Promised output schema (from the provider)

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "properties": {
    "input": {
      "additionalProperties": false,
      "properties": {
        "method": {
          "enum": [
            "GET",
            "POST",
            "PUT",
            "PATCH",
            "DELETE",
            "HEAD"
          ],
          "type": "string"
        },
        "queryParams": {
          "properties": {
            "url": {
              "description": "Public http(s) URL or bare domain to audit; private, loopback and link-local addresses are refused",
              "examples": [
                "https://example.com",
                "github.com"
              ],
              "maxLength": 2000,
              "pattern": "^(https?://)?[A-Za-z0-9.-]+\\.[A-Za-z]{2,}.*$",
              "type": "string"
            }
          },
          "required": [
            "url"
          ],
          "type": "object"
        },
        "type": {
          "const": "http",
          "type": "string"
        }
      },
      "required": [
        "type",
        "method"
      ],
      "type": "object"
    },
    "output": {
      "properties": {
        "example": {
          "properties": {
            "checked_at": {
              "description": "Time the check was run (UTC)",
              "type": [
                "string",
                "null"
              ]
            },
            "findings": {
              "description": "One entry per header or check",
              "items": {
                "properties": {
                  "detail": {
                    "description": "What was observed",
                    "type": "string"
                  },
                  "fix": {
                    "description": "Recommended header value or action, or null",
                    "type": [
                      "string",
                      "null"
                    ]
                  },
                  "header": {
                    "description": "Header or check name",
                    "type": "string"
                  },
                  "status": {
                    "description": "pass, warn, fail or info",
                    "type": "string"
                  }
                },
                "type": "object"
              },
              "type": "array"
            },
            "grade": {
              "description": "Letter grade A to F",
              "type": "string"
            },
            "http_status": {
              "description": "HTTP status code returned",
              "type": [
                "number",
                "null"
              ]
            },
            "https": {
              "description": "True when the final URL is HTTPS",
              "type": "boolean"
            },
            "redirects": {
              "description": "Redirect chain followed",
              "type": [
                "number",
                "null"
              ]
            },
            "scope": {
              "description": "Scope the result covers",
              "type": [
                "string",
                "null"
              ]
            },
            "score": {
              "description": "Score from 0 to 100 (penalties per missing or weak header)",
              "type": "number"
            },
            "summary": {
              "description": "Counts of failing, warning and passing checks",
              "type": "object"
            },
            "url": {
              "description": "Final URL after redirects that was audited",
              "type": "string"
            }
          },
          "required": [
            "url",
            "grade",
            "score",
            "findings"
          ],
          "type": "object"
        },
        "type": {
          "const": "json",
          "type": "string"
        }
      },
      "required": [
        "type"
      ],
      "type": "object"
    }
  },
  "required": [
    "input"
  ],
  "type": "object"
}

This page as JSON