Security Headers

What It Does

Fetches the target URL (with configurable redirect following) and inspects all security-related HTTP response headers. Each header is scored against known good values: HSTS is checked for max-age ≥ 1 year, includeSubDomains, and preload; CSP is validated for presence and baseline directives; X-Frame-Options is checked for DENY or SAMEORIGIN; X-Content-Type-Options must be nosniff; Referrer-Policy is evaluated against recommended values (no-referrer, strict-origin-when-cross-origin). The deprecated X-XSS-Protection header is detected and flagged — modern browsers have removed XSS Auditor support, and CSP is the recommended replacement. A composite grade is computed from all header scores.

Why It's Useful

HTTP security headers are your first line of defense against common web attacks including XSS, clickjacking, MIME-sniffing, and protocol downgrade attacks. OWASP, Mozilla Observatory, and compliance frameworks (PCI-DSS 4.0, SOC 2, HIPAA) all recommend these headers. Regular auditing catches misconfigurations before attackers exploit them — 67% of websites are missing at least one critical security header according to recent surveys.

Use Cases

Parameters

Response Fields

Code Examples

curl "https://api.edgedns.dev/v1/security/headers" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d "url=https://example.com"

const response = await fetch(
  'https://api.edgedns.dev/v1/security/headers?url=https%3A%2F%2Fexample.com',
  {
    headers: {
      'Authorization': 'Bearer YOUR_API_KEY'
    }
  }
);

const data = await response.json();
console.log(data);

import requests

response = requests.get(
    'https://api.edgedns.dev/v1/security/headers',
    headers={'Authorization': 'Bearer YOUR_API_KEY'},
    params={
    'url': 'https://example.com'
    }
)

data = response.json()
print(data)

Related Endpoints

External References

Learn more about the standards and protocols behind this endpoint.