Security Headers API Reference
Analyze the HTTP security headers of a URL: check which security headers are present, missing, or misconfigured, with details for each header, and get a security score.
Service details and pricing: Security Headers API
POSThttps://api.apivoid.com/v2/security-headers
AuthenticationSend your API key in the X-API-Key header to authenticate.Credits & quotaTrack credits usage via the X-Service-Quota response header.Errors & retriesError format, status codes and safe retry rules, with real examples.
Request example
Query the endpoint via an HTTPS POST request (replace YOUR_API_KEY_HERE with your API key):
curl
curl -X POST "https://api.apivoid.com/v2/security-headers" \
-H "Content-Type: application/json" \
-H "X-API-Key: YOUR_API_KEY_HERE" \
-d '{"url": "https://stripe.com/"}'The same request in PHP:
php
$url = 'https://stripe.com/';
$apiKey = 'YOUR_API_KEY_HERE';
$curl = curl_init('https://api.apivoid.com/v2/security-headers');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['url' => $url]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);
if ($httpCode === 200) {
$responseData = json_decode($response, true);
print_r($responseData);
} else {
print_r('An error occurred: '.$response);
}Request parameters
Required
urlstringRequired
URL to submit, e.g. https://stripe.com/.
Response example
A successful request returns HTTP 200 with a JSON body:
json · 200
{
"url": "https://stripe.com/",
"final_url": "https://stripe.com/en-fi",
"ip": "54.76.53.164",
"status_code": 200,
"response_note": "",
"connection_error": false,
"access_restricted": false,
"response_headers": {
"content-security-policy": [
"base-uri 'none'; child-src 'none'; connect-src https://c.increment.com https://c.stripe.dev https://c.stripe.global https://c.stripe.partners blob: https://b.stripecdn.com https://errors.stripe.com https://ext.stripe.com https://r.stripe.com https://stripe-images.s3.us-west-1.amazonaws.com https://stripe.com 'self'; default-src 'none'; font-src https://b.stripecdn.com 'self'; form-action https://stripe.com 'self'; frame-ancestors https://app.contentful.com 'self'; frame-src https://b.stripecdn.com https://js.stripe.com https://support-conversations.stripe.com 'self'; img-src data: https://assets.ctfassets.net https://assets.stripeassets.com https://b.stripecdn.com https://images.ctfassets.net https://images.stripeassets.com https://q.stripe.com 'self'; manifest-src 'none'; media-src https://assets.ctfassets.net https://assets.stripeassets.com https://b.stripecdn.com https://videos.ctfassets.net https://videos.stripeassets.com 'self'; object-src 'none'; script-src https://b.stripecdn.com https://js.stripe.com 'self' 'sha256-3aWvb9tRBjmz1OjR3n7mwiTm94+s4iki4mMZF82asmc=' 'sha256-5LtzXhT7UFn+GqP5pKEMGL08UNZsrzANHFEBW/mQHGw=' 'sha256-beLzNcen8LrazzSCRjAapoIMTgJI0osPWGNSX7aK6lc=' 'sha256-cCM0Z4lzGkzQnmbdVw+ouz0JRawyaKcZ4yiqzqYS7ek=' 'sha256-vTifGUJH6hJYTvstw4xJ4xfr/vE0ELkOV4GpCumyqfg=' 'sha256-KxhSaxKB5RFTQsqfRwp+zG7iLjvMrTAySqnSvWlqct0=' 'sha256-tMuJ8c00j54yuxogrdIJeGhNVB350dc56i969XRz/Mc=' 'sha256-aEFSvCaVnb2wNwuO3IzA8J44RdTKt6vms9beA7BcCYg=' 'sha256-0SWEc2BfR2o77i2vUiNNIrFKQkjc2Ujsr2hlfZ6oUek=' 'report-sample'; style-src https://b.stripecdn.com 'self' 'unsafe-inline'; worker-src https://b.stripecdn.com 'self'; upgrade-insecure-requests; report-uri https://q.stripe.com/csp-violation?q=s19Fnq91o9H4NDVx-N7qNHjvHjJd5CM9iCDBgcEd6Ky75-HIBDtVZY0Veb2cUyQ%3D"
],
"content-type": [
"text/html; charset=utf-8"
],
"cross-origin-opener-policy": [
"same-origin-allow-popups; report-to=\"wsp_coop\""
],
"cross-origin-opener-policy-report-only": [
"same-origin-allow-popups; report-to=\"wsp_coop\""
],
"date": [
"Tue, 17 Mar 2026 15:46:41 GMT"
],
"referrer-policy": [
"no-referrer-when-downgrade"
],
"report-to": [
"{\"group\":\"wsp_coop\",\"max_age\":8640,\"endpoints\":[{\"url\":\"https://q.stripe.com/coop-report?s=s19Fnq91o9H4NDVx-N7qNHjvHjJd5CM9iCDBgcEd6Ky75-HIBDtVZY0Veb2cUyQ=\"}],\"include_subdomains\":true},{\"group\":\"wsp_coep\",\"max_age\":8640,\"endpoints\":[{\"url\":\"https://q.stripe.com/coep-report?s=s19Fnq91o9H4NDVx-N7qNHjvHjJd5CM9iCDBgcEd6Ky75-HIBDtVZY0Veb2cUyQ=\"}],\"include_subdomains\":true}"
],
"reporting-endpoints": [
"coop=\"https://q.stripe.com/coop-report\", wsp_coop=\"https://q.stripe.com/coop-report?s=s19Fnq91o9H4NDVx-N7qNHjvHjJd5CM9iCDBgcEd6Ky75-HIBDtVZY0Veb2cUyQ=\",wsp_coep=\"https://q.stripe.com/coep-report?s=s19Fnq91o9H4NDVx-N7qNHjvHjJd5CM9iCDBgcEd6Ky75-HIBDtVZY0Veb2cUyQ=\""
],
"server": [
"nginx"
],
"strict-transport-security": [
"max-age=63072000; includeSubDomains; preload"
],
"x-content-type-options": [
"nosniff"
],
"x-frame-options": [
"SAMEORIGIN"
],
"x-mkt-cache": [
"HIT"
],
"x-stripe-proxy-response": [
"upstream"
],
"x-stripe-server-rpc-duration-micros": [
"44130"
],
"x-wc": [
"ABCDEFGHIJ"
]
},
"security_headers": [
{
"name": "strict-transport-security",
"reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security",
"found": true,
"value": [
"max-age=63072000; includeSubDomains; preload"
],
"issues": []
},
{
"name": "content-security-policy",
"reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",
"found": true,
"value": [
"base-uri 'none'; child-src 'none'; connect-src https://c.increment.com https://c.stripe.dev https://c.stripe.global https://c.stripe.partners blob: https://b.stripecdn.com https://errors.stripe.com https://ext.stripe.com https://r.stripe.com https://stripe-images.s3.us-west-1.amazonaws.com https://stripe.com 'self'; default-src 'none'; font-src https://b.stripecdn.com 'self'; form-action https://stripe.com 'self'; frame-ancestors https://app.contentful.com 'self'; frame-src https://b.stripecdn.com https://js.stripe.com https://support-conversations.stripe.com 'self'; img-src data: https://assets.ctfassets.net https://assets.stripeassets.com https://b.stripecdn.com https://images.ctfassets.net https://images.stripeassets.com https://q.stripe.com 'self'; manifest-src 'none'; media-src https://assets.ctfassets.net https://assets.stripeassets.com https://b.stripecdn.com https://videos.ctfassets.net https://videos.stripeassets.com 'self'; object-src 'none'; script-src https://b.stripecdn.com https://js.stripe.com 'self' 'sha256-3aWvb9tRBjmz1OjR3n7mwiTm94+s4iki4mMZF82asmc=' 'sha256-5LtzXhT7UFn+GqP5pKEMGL08UNZsrzANHFEBW/mQHGw=' 'sha256-beLzNcen8LrazzSCRjAapoIMTgJI0osPWGNSX7aK6lc=' 'sha256-cCM0Z4lzGkzQnmbdVw+ouz0JRawyaKcZ4yiqzqYS7ek=' 'sha256-vTifGUJH6hJYTvstw4xJ4xfr/vE0ELkOV4GpCumyqfg=' 'sha256-KxhSaxKB5RFTQsqfRwp+zG7iLjvMrTAySqnSvWlqct0=' 'sha256-tMuJ8c00j54yuxogrdIJeGhNVB350dc56i969XRz/Mc=' 'sha256-aEFSvCaVnb2wNwuO3IzA8J44RdTKt6vms9beA7BcCYg=' 'sha256-0SWEc2BfR2o77i2vUiNNIrFKQkjc2Ujsr2hlfZ6oUek=' 'report-sample'; style-src https://b.stripecdn.com 'self' 'unsafe-inline'; worker-src https://b.stripecdn.com 'self'; upgrade-insecure-requests; report-uri https://q.stripe.com/csp-violation?q=s19Fnq91o9H4NDVx-N7qNHjvHjJd5CM9iCDBgcEd6Ky75-HIBDtVZY0Veb2cUyQ%3D"
],
"issues": []
},
{
"name": "x-content-type-options",
"reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options",
"found": true,
"value": [
"nosniff"
],
"issues": []
},
{
"name": "x-xss-protection",
"reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection",
"found": false,
"value": [],
"issues": [
{
"code": "MISSING_X_XSS_PROTECTION",
"message": "X-XSS-Protection header is missing. This is acceptable as the header is deprecated.",
"type": "information"
}
]
},
{
"name": "referrer-policy",
"reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy",
"found": true,
"value": [
"no-referrer-when-downgrade"
],
"issues": [
{
"code": "REFERRER_POLICY_WEAK",
"message": "Referrer-Policy 'no-referrer-when-downgrade' may leak referrer to third-party origins over HTTPS.",
"type": "information"
}
]
},
{
"name": "permissions-policy",
"reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy",
"found": false,
"value": [],
"issues": [
{
"code": "MISSING_PERMISSIONS_POLICY",
"message": "Permissions-Policy header is missing.",
"type": "error"
}
]
},
{
"name": "x-frame-options",
"reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options",
"found": true,
"value": [
"SAMEORIGIN"
],
"issues": []
},
{
"name": "cross-origin-opener-policy",
"reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Opener-Policy",
"found": true,
"value": [
"same-origin-allow-popups; report-to=\"wsp_coop\""
],
"issues": []
},
{
"name": "cross-origin-embedder-policy",
"reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy",
"found": false,
"value": [],
"issues": [
{
"code": "MISSING_COEP",
"message": "Cross-Origin-Embedder-Policy header is missing.",
"type": "information"
}
]
},
{
"name": "cross-origin-resource-policy",
"reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Resource-Policy",
"found": false,
"value": [],
"issues": [
{
"code": "MISSING_CORP",
"message": "Cross-Origin-Resource-Policy header is missing.",
"type": "information"
}
]
}
],
"cors": {
"present": false,
"configuration": {
"allow_origin": "",
"allow_credentials": false,
"allow_methods": [],
"allow_headers": [],
"expose_headers": [],
"max_age": 0
},
"issues": []
},
"information_leakage": [
{
"name": "server",
"found": true,
"value": [
"nginx"
],
"issues": []
}
],
"duplicate_headers": [],
"cookies": [],
"summary": {
"security_headers": {
"checked": 10,
"found": 6,
"missing": 4
},
"issues": {
"errors": 1,
"warnings": 0,
"information": 4
}
},
"score": 94,
"max_score": 100,
"grade": "A",
"elapsed_ms": 524
}Response fields
The fields returned in the JSON response:
urlstring
URL submitted for the security headers check.
final_urlstring
Final URL after following redirects.
ipstring
IP address of the server that served the page.
status_codeinteger
HTTP status code returned by the server.
response_notestring
Additional note about the HTTP response, if any.
connection_errorboolean
Returns true if the connection to the server failed.
access_restrictedboolean
Returns true if access to the page is restricted (e.g. by a firewall or captcha).
response_headersobject
HTTP response headers returned by the server, keyed by lowercase header name.
security_headersarray
List of security headers checked with their status and issues.
security_headers[n] → namestring
Name of the security header, lowercase, e.g. content-security-policy.
security_headers[n] → referencestring
Reference URL with documentation about the header.
security_headers[n] → foundboolean
Returns true if the security header is present.
security_headers[n] → valuearray
Values of the security header, if present.
security_headers[n] → issuesarray
Issues found with the header configuration; each item has code, message and type.
security_headers[n] → issues[n] → codestring
Machine-readable issue code, e.g. MISSING_CORP.
security_headers[n] → issues[n] → messagestring
Human-readable description of the issue.
security_headers[n] → issues[n] → typestring
Issue severity: error, warning or information.
cors → presentboolean
Returns true if CORS headers are present.
cors → configuration → allow_originstring
Value of the Access-Control-Allow-Origin header.
cors → configuration → allow_credentialsboolean
Returns true if Access-Control-Allow-Credentials is enabled.
cors → configuration → allow_methodsarray
HTTP methods allowed by the CORS configuration.
cors → configuration → allow_headersarray
Headers allowed by the CORS configuration.
cors → configuration → expose_headersarray
Headers exposed by the CORS configuration.
cors → configuration → max_ageinteger
Max age of the CORS preflight cache in seconds.
cors → issuesarray
Issues found with the CORS configuration.
information_leakagearray
Headers that may leak information about the server or technology stack.
information_leakage[n] → namestring
Name of the header, lowercase, e.g. server, x-powered-by.
information_leakage[n] → foundboolean
Returns true if the header is present.
information_leakage[n] → valuearray
Values of the header, if present.
information_leakage[n] → issuesarray
Issues found related to the information disclosed.
duplicate_headersarray
Headers that appear more than once in the response.
cookiesarray
Cookies set by the server with their security attributes.
summary → security_headers → checkedinteger
Number of security headers checked.
summary → security_headers → foundinteger
Number of security headers found.
summary → security_headers → missinginteger
Number of security headers missing.
summary → issues → errorsinteger
Number of issues with error severity.
summary → issues → warningsinteger
Number of issues with warning severity.
summary → issues → informationinteger
Number of issues with informational severity.
scoreinteger
Security headers score of the page (0 bad, 100 good).
max_scoreinteger
Maximum achievable score, e.g. 100.
gradestring
Grade assigned based on the score, e.g. A+, A, A-, B+, B, B-, C+, C, C-, D+, D, D-, F.
elapsed_msinteger
Time taken to process the request, in milliseconds.