Site Trustworthiness API Reference
Get a trust score of a website, useful to spot potentially fraudulent and insecure web shops, with detailed security and content checks.
Service details and pricing: Site Trustworthiness API
Request example
Query the endpoint via an HTTPS POST request (replace YOUR_API_KEY_HERE with your API key):
curl -X POST "https://api.apivoid.com/v2/site-trust" \
-H "Content-Type: application/json" \
-H "X-API-Key: YOUR_API_KEY_HERE" \
-d '{"host": "amazon.com"}'The same request in PHP:
$host = 'amazon.com';
$apiKey = 'YOUR_API_KEY_HERE';
$curl = curl_init('https://api.apivoid.com/v2/site-trust');
curl_setopt($curl, CURLOPT_HTTPHEADER, ['Content-Type: application/json', 'X-API-Key: ' . $apiKey]);
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, json_encode(['host' => $host]));
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($curl);
$httpCode = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);
if ($httpCode === 200) {
$responseData = json_decode($response, true);
print_r($responseData);
} else {
print_r('An error occurred: '.$response);
}Request parameters
Required
Host to submit, e.g. amazon.com (without the www).
⚠ Government and educational domains are blocked.
Response example
A successful request returns HTTP 200 with a JSON body:
{
"host": "amazon.com",
"dns_records": {
"ns": [
{
"target": "ns1.amzndns.org",
"ip": "156.154.66.10",
"country_code": "US",
"country_name": "United States of America",
"isp": "Vercara LLC"
},
{
"target": "ns2.amzndns.co.uk",
"ip": "204.74.120.1",
"country_code": "US",
"country_name": "United States of America",
"isp": "Vercara LLC"
},
{
"target": "ns2.amzndns.com",
"ip": "156.154.68.10",
"country_code": "US",
"country_name": "United States of America",
"isp": "Vercara LLC"
},
{
"target": "ns2.amzndns.net",
"ip": "156.154.69.10",
"country_code": "US",
"country_name": "United States of America",
"isp": "Vercara LLC"
},
{
"target": "ns2.amzndns.org",
"ip": "156.154.150.1",
"country_code": "US",
"country_name": "United States of America",
"isp": "Vercara LLC"
},
{
"target": "ns1.amzndns.co.uk",
"ip": "156.154.67.10",
"country_code": "US",
"country_name": "United States of America",
"isp": "Vercara LLC"
},
{
"target": "ns1.amzndns.com",
"ip": "156.154.64.10",
"country_code": "US",
"country_name": "United States of America",
"isp": "Vercara LLC"
}
],
"mx": [
{
"target": "amazon-smtp.amazon.com",
"ip": "52.28.202.117",
"country_code": "DE",
"country_name": "Germany",
"isp": "A100 ROW GmbH"
}
],
"cname": ""
},
"domain_blacklist": {
"engines": {
"0": {
"name": "ANJ Blocked Sites",
"detected": false,
"reference": "https://anj.fr/",
"confidence": "high",
"elapsed_ms": 0
},
"1": {
"name": "AntiSocial Blacklist",
"detected": false,
"reference": "https://theantisocialengineer.com/",
"confidence": "high",
"elapsed_ms": 0
},
"2": {
"name": "APVA",
"detected": false,
"reference": "https://www.antiphish.org/",
"confidence": "high",
"elapsed_ms": 0
},
"3": {
"name": "Artists Against 419",
"detected": false,
"reference": "https://wiki.aa419.org/index.php/Main_Page",
"confidence": "high",
"elapsed_ms": 0
},
"4": {
"name": "AZORult Tracker",
"detected": false,
"reference": "https://azorult-tracker.net/",
"confidence": "high",
"elapsed_ms": 0
},
"5": {
"name": "Badbitcoin",
"detected": false,
"reference": "https://badbitcoin.org/",
"confidence": "high",
"elapsed_ms": 0
},
"6": {
"name": "Bambenek Consulting",
"detected": false,
"reference": "https://www.bambenekconsulting.com/",
"confidence": "high",
"elapsed_ms": 0
},
"7": {
"name": "CERT Polska",
"detected": false,
"reference": "https://www.cert.pl/",
"confidence": "high",
"elapsed_ms": 0
},
"8": {
"name": "COI CZ",
"detected": false,
"reference": "https://coi.gov.cz/",
"confidence": "high",
"elapsed_ms": 0
},
"9": {
"name": "CryptoScamDB",
"detected": false,
"reference": "https://cryptoscamdb.org/",
"confidence": "high",
"elapsed_ms": 0
},
"10": {
"name": "EtherAddressLookup",
"detected": false,
"reference": "https://github.com/409H/EtherAddressLookup/",
"confidence": "high",
"elapsed_ms": 0
},
...
},
"detections": 0,
"engines_count": 42,
"detection_rate": "0%",
"scan_time_ms": 120
},
"ecommerce_platform": {
"is_shopify": false,
"is_woocommerce": false,
"is_opencart": false,
"is_prestashop": false,
"is_magento": false,
"is_zencart": false,
"is_other": false
},
"geo_location": {
"countries": [
"US",
"DE"
]
},
"html_info": {
"title": "Amazon.com. Spend less. Smile more.",
"description": "Free shipping on millions of items. Get the best of Shopping and Entertainment with Prime. Enjoy low prices and great deals on the largest selection of everyday essentials and other products, including fashion, home, beauty, electronics, Alexa Devices, sporting goods, toys, automotive, pets, baby, books, video games, musical instruments, office supplies, and more.",
"keywords": "Amazon, Amazon.com, Books, Online Shopping, Book Store, Magazine, Subscription, Music, CDs, DVDs, Videos, Electronics, Video Games, Computers, Cell Phones, Toys, Games, Apparel, Accessories, Shoes, Jewelry, Watches, Office Products, Sports & Outdoors, Sporting Goods, Baby Products, Health, Personal Care, Beauty, Home, Garden, Bed & Bath, Furniture, Tools, Hardware, Vacuums, Outdoor Living, Automotive Parts, Pet Supplies, Broadband, DSL",
"robots": "",
"canonical": "https://www.amazon.com/",
"og_image": "https://m.media-amazon.com/images/I/31epF-8N9LL.png",
"article_publisher": "",
"og_site_name": "",
"twitter_site": "",
"generator": "",
"ld_organization": "",
"lang": "en-us"
},
"redirection": {
"found": false,
"external": false,
"url": ""
},
"response_headers": {
"code": 200,
"status": "HTTP/2 200",
"content-type": "text/html",
"server": "Server",
"date": "Tue, 23 Dec 2025 16:13:51 GMT",
"x-amz-rid": "E158SRJTEWGJ2DDFSFZ4",
"set-cookie": "skin=noskin; path=/; domain=.amazon.com",
"vary": "Content-Type,Accept-Encoding,User-Agent",
"last-modified": "Tue, 23 Dec 2025 16:13:48 GMT",
"etag": "\"178e45-646a0d4277060-gzip\"",
"accept-ranges": "bytes",
"content-encoding": "gzip",
"strict-transport-security": "max-age=47474747; includeSubDomains; preload",
"x-frame-options": "SAMEORIGIN",
"x-cache": "Miss from cloudfront",
"via": "1.1 d31c4c288ffef497f9a848a4bcb51e54.cloudfront.net (CloudFront)",
"x-amz-cf-pop": "ATL58-P3",
"alt-svc": "h3=\":443\"; ma=86400",
"x-amz-cf-id": "gKbTOmeZcd0lzdM2oZoxnX0vlyLpN0x8zH3z1E-hZ0haAS0ilEubwg=="
},
"security_checks": {
"is_suspended_site": false,
"is_most_abused_tld": false,
"is_robots_noindex": false,
"is_website_accessible": true,
"is_empty_page_content": false,
"is_redirect_to_search_engine": false,
"is_suspicious_redirect": false,
"http_status_code": 200,
"is_http_status_error": false,
"is_http_server_error": false,
"is_http_client_error": false,
"is_empty_page_title": false,
"is_ipv6_enabled": false,
"is_domain_blacklisted": false,
"is_suspicious_domain": false,
"is_sinkholed_domain": false,
"is_http_redirected_to_https": true,
"is_directory_listing": false,
"is_domain_ipv4_assigned": true,
"is_domain_ipv4_private": false,
"is_domain_ipv4_loopback": false,
"is_domain_ipv4_reserved": false,
"is_domain_ipv4_valid": true,
"is_uncommon_host_length": false,
"is_uncommon_dash_char_count": false,
"is_uncommon_dot_char_count": false,
"is_email_configured": true,
"is_email_spoofable": true,
"is_dmarc_configured": true,
"is_dmarc_enforced": true,
"is_caa_configured": false,
"is_external_redirect": false,
"is_custom_404_configured": true,
"is_valid_https": true,
"is_ssl_blacklisted": false,
"is_ssl_expired": false,
"is_ssl_revoked": false,
"ssl_type": "Domain Validation",
"ssl_issuer_organization": "DigiCert Inc",
"ssl_issuer_country": "US",
"ssl_subject_organization": "",
"ssl_subject_common_name": "www.amazon.com",
"ssl_subject_country": "",
"is_hsts_header": true,
"is_referrer_policy_header": false,
"is_unsafe_url_in_referrer_policy_header": false,
"is_csp_header": false,
"is_unsafe_eval_in_csp_header": false,
"is_unsafe_inline_in_csp_header": false,
"is_content_type_options_header": false,
"is_frame_options_header": true,
"is_xss_protection_header": false,
"is_permissions_policy_header": false,
"is_set_cookie_header": true,
"is_secure_on_all_cookies": false,
"is_server_header_exposing_version": false,
"is_powered_by_header_exposed": false,
"is_aspnet_version_header_exposed": false,
"is_dnssec_enabled": false,
"is_dnssec_signed": false,
"is_defaced_heuristic": false,
"is_website_popular": true,
"is_domain_recent": "no",
"is_domain_very_recent": "no",
"domain_creation_date": "1994-11-01",
"domain_age_in_days": 11375,
"domain_age_in_months": 366,
"domain_age_in_years": 31,
"is_ecommerce_platform": false,
"is_high_discounts": false,
"is_fake_socials": false,
"is_heuristic_pattern": false,
"is_free_email": false,
"is_risky_geo_location": false,
"is_china_country": false,
"is_nigeria_country": false
},
"server_details": {
"ip": "98.82.161.185",
"hostname": "ec2-98-82-161-185.compute-1.amazonaws.com",
"continent_code": "NA",
"continent_name": "North America",
"country_code": "US",
"country_name": "United States of America",
"region_name": "Virginia",
"city_name": "Ashburn",
"latitude": 39.039474,
"longitude": -77.491809,
"isp": "Amazon Technologies Inc.",
"asn": "AS14618"
},
"trust_score": {
"result": 100
},
"url_parts": {
"scheme": "https",
"host": "www.amazon.com",
"host_nowww": "amazon.com",
"port": 443,
"path": "/",
"query": ""
},
"elapsed_ms": 3123
}Response fields
The fields returned in the JSON response:
hoststring
Host submitted for the trustworthiness analysis.
dns_records → nsarray
NS records of the domain; each item has target, ip, country_code, country_name and isp.
dns_records → ns[n] → targetstring
Name server hostname.
dns_records → ns[n] → ipstring
IPv4 address of the name server.
dns_records → ns[n] → country_codestring
Country code (e.g. US) of the name server IP address.
dns_records → ns[n] → country_namestring
Country name of the name server IP address.
dns_records → ns[n] → ispstring
Internet Service Provider (ISP) of the name server IP address.
dns_records → mxarray
MX records of the domain; each item has target, ip, country_code, country_name and isp.
dns_records → mx[n] → targetstring
Mail server hostname.
dns_records → mx[n] → ipstring
IPv4 address of the mail server.
dns_records → mx[n] → country_codestring
Country code (e.g. US) of the mail server IP address.
dns_records → mx[n] → country_namestring
Country name of the mail server IP address.
dns_records → mx[n] → ispstring
Internet Service Provider (ISP) of the mail server IP address.
dns_records → cnamestring
CNAME target of the host. Empty string if none.
domain_blacklist → enginesobject
List of scanning engines; each item has name, detected, reference, confidence and elapsed_ms.
domain_blacklist → engines → [index] → namestring
Name of the scanning engine.
domain_blacklist → engines → [index] → detectedboolean
Returns true if this engine flagged the submitted domain.
domain_blacklist → engines → [index] → referencestring
Link to the engine's website or listing details.
domain_blacklist → engines → [index] → confidencestring
Confidence of this engine detection, e.g. high.
domain_blacklist → engines → [index] → elapsed_msinteger
Time taken by this engine to complete its check, in milliseconds.
domain_blacklist → detectionsinteger
Number of scanning engines that detected the domain.
domain_blacklist → engines_countinteger
Number of scanning engines used to scan the domain.
domain_blacklist → detection_ratestring
Percentage of engines that detected the domain, e.g. 5%.
domain_blacklist → scan_time_msinteger
Time taken to scan the domain across all engines, in milliseconds.
ecommerce_platform → is_shopifyboolean
Returns true if the website runs on Shopify.
ecommerce_platform → is_woocommerceboolean
Returns true if the website runs on WooCommerce.
ecommerce_platform → is_opencartboolean
Returns true if the website runs on OpenCart.
ecommerce_platform → is_prestashopboolean
Returns true if the website runs on PrestaShop.
ecommerce_platform → is_magentoboolean
Returns true if the website runs on Magento.
ecommerce_platform → is_zencartboolean
Returns true if the website runs on Zen Cart.
ecommerce_platform → is_otherboolean
Returns true if the website runs on another known e-commerce platform.
geo_location → countriesarray
List of potential countries of origin.
html_info → titlestring
Title of the page.
html_info → descriptionstring
Meta description of the page.
html_info → keywordsstring
Contents of the meta keywords tag.
html_info → robotsstring
Robots meta tag of the page.
html_info → canonicalstring
Canonical URL of the page.
html_info → og_imagestring
Open Graph image URL of the page.
html_info → article_publisherstring
Contents of the article:publisher Open Graph tag. Empty string if none.
html_info → og_site_namestring
Open Graph site name of the page.
html_info → twitter_sitestring
Twitter site handle of the page.
html_info → generatorstring
CMS or framework from meta generator tag (e.g. WordPress).
html_info → ld_organizationstring
Organization name found in JSON-LD structured data.
html_info → langstring
Language declared by the page, e.g. en-US.
redirection → foundboolean
Returns true if the website redirects to another URL.
redirection → externalboolean
Returns true if the redirect points to an external host.
redirection → urlstring
Destination URL of the redirect. Empty string if none.
response_headersobject
HTTP response headers returned by the server, keyed by lowercase header name.
security_checks → is_suspended_siteboolean
Returns true if the website appears suspended by the hosting provider.
security_checks → is_most_abused_tldboolean
Returns true if the domain TLD is risky, e.g. .top or .tk.
security_checks → is_robots_noindexboolean
Returns true if URL "doesn't want" to be indexed on Google.
security_checks → is_website_accessibleboolean
Returns true if website is accessible by our servers (status code is 2xx or 3xx).
security_checks → is_empty_page_contentboolean
Returns true if website page content is empty.
security_checks → is_redirect_to_search_engineboolean
Returns true if website redirects to search engines, like google.com.
security_checks → is_suspicious_redirectboolean
Returns true if the redirect matches our suspicious redirect rules.
security_checks → http_status_codeinteger
HTTP status code returned by the website, e.g. 200.
security_checks → is_http_status_errorboolean
Returns true if the HTTP status code is an error (4xx or 5xx).
security_checks → is_http_server_errorboolean
Returns true if the HTTP status code is a server error (5xx).
security_checks → is_http_client_errorboolean
Returns true if the HTTP status code is a client error (4xx).
security_checks → is_empty_page_titleboolean
Returns true if website page title is empty.
security_checks → is_ipv6_enabledboolean
Returns true if host has IPv6 AAAA records configured.
security_checks → is_domain_blacklistedboolean
Returns true if domain is blacklisted by trusted sources.
security_checks → is_suspicious_domainboolean
Returns true if domain matches our suspicious domain rules.
security_checks → is_sinkholed_domainboolean
Returns true if domain is sinkholed (malicious).
security_checks → is_http_redirected_to_httpsboolean
Returns true if HTTP requests are redirected to HTTPS.
security_checks → is_directory_listingboolean
Returns true if website is a directory listing.
security_checks → is_domain_ipv4_assignedboolean
Returns true if the domain resolves to an assigned IPv4 address.
security_checks → is_domain_ipv4_privateboolean
Returns true if the domain resolves to a private IPv4 address.
security_checks → is_domain_ipv4_loopbackboolean
Returns true if the domain resolves to a loopback (e.g. 127.0.0.1) IPv4 address.
security_checks → is_domain_ipv4_reservedboolean
Returns true if the domain resolves to a reserved IPv4 address.
security_checks → is_domain_ipv4_validboolean
Returns true if the domain resolves to a valid public IPv4 address.
security_checks → is_uncommon_host_lengthboolean
Returns true if the host length is uncommon (such as, a very long domain).
security_checks → is_uncommon_dash_char_countboolean
Returns true if the host contains too many dash "-" characters.
security_checks → is_uncommon_dot_char_countboolean
Returns true if the host contains too many dot "." characters.
security_checks → is_email_configuredboolean
Returns true if the domain has MX records configured to receive email.
security_checks → is_email_spoofableboolean
Returns true if the domain's email can be spoofed due to missing or weak SPF/DMARC configuration.
security_checks → is_dmarc_configuredboolean
Returns true if the domain has a DMARC record.
security_checks → is_dmarc_enforcedboolean
Returns true if the DMARC policy is enforced (p=quarantine or p=reject).
security_checks → is_caa_configuredboolean
Returns true if the domain has CAA records configured.
security_checks → is_external_redirectboolean
Returns true if the URL redirects to an external website.
security_checks → is_custom_404_configuredboolean
Returns true if the website returns a custom 404 error page.
security_checks → is_valid_httpsboolean
Returns true if the URL HTTPS (SSL) is valid.
security_checks → is_ssl_blacklistedboolean
Returns true if the SSL certificate is blacklisted by trusted sources.
security_checks → is_ssl_expiredboolean
Returns true if the SSL certificate is expired.
security_checks → is_ssl_revokedboolean
Returns true if the SSL certificate has been revoked.
security_checks → ssl_typestring
SSL certificate type, can be Domain Validation, Organization Validation or Extended Validation.
security_checks → ssl_issuer_organizationstring
Organization that issued the SSL certificate, e.g. DigiCert Inc.
security_checks → ssl_issuer_countrystring
Country of the SSL certificate issuer.
security_checks → ssl_subject_organizationstring
Organization in the SSL certificate subject. Empty string if not present.
security_checks → ssl_subject_common_namestring
Common Name (CN) in the SSL certificate subject.
security_checks → ssl_subject_countrystring
Country in the SSL certificate subject. Empty string if not present.
security_checks → is_hsts_headerboolean
Returns true if the Strict-Transport-Security (HSTS) header is present.
security_checks → is_referrer_policy_headerboolean
Returns true if the Referrer-Policy header is present.
security_checks → is_unsafe_url_in_referrer_policy_headerboolean
Returns true if the Referrer-Policy header uses the unsafe-url value.
security_checks → is_csp_headerboolean
Returns true if the Content-Security-Policy header is present.
security_checks → is_unsafe_eval_in_csp_headerboolean
Returns true if the Content-Security-Policy header contains unsafe-eval.
security_checks → is_unsafe_inline_in_csp_headerboolean
Returns true if the Content-Security-Policy header contains unsafe-inline.
security_checks → is_content_type_options_headerboolean
Returns true if the X-Content-Type-Options header is present.
security_checks → is_frame_options_headerboolean
Returns true if the X-Frame-Options header is present.
security_checks → is_xss_protection_headerboolean
Returns true if the X-XSS-Protection header is present.
security_checks → is_permissions_policy_headerboolean
Returns true if the Permissions-Policy header is present.
security_checks → is_set_cookie_headerboolean
Returns true if the website sets cookies via the Set-Cookie header.
security_checks → is_secure_on_all_cookiesboolean
Returns true if all cookies are set with the Secure attribute.
security_checks → is_server_header_exposing_versionboolean
Returns true if the Server header exposes the software version.
security_checks → is_powered_by_header_exposedboolean
Returns true if the X-Powered-By header is exposed.
security_checks → is_aspnet_version_header_exposedboolean
Returns true if the X-AspNet-Version header is exposed.
security_checks → is_dnssec_enabledboolean
Returns true if DNSSEC is enabled for the domain.
security_checks → is_dnssec_signedboolean
Returns true if the DNS response is signed with DNSSEC.
security_checks → is_defaced_heuristicboolean
Returns true if website has been defaced (we use our own rules).
security_checks → is_website_popularboolean
Returns true if the website is present in popular website rankings.
security_checks → is_domain_recentstring
Returns "yes" if domain was created less than 6 months ago, can be yes/no/unknown.
security_checks → is_domain_very_recentstring
Returns "yes" if domain was created less than 30 days ago, can be yes/no/unknown.
security_checks → domain_creation_datestring
Domain registration date, format is Y-m-d (empty if unknown).
security_checks → domain_age_in_daysinteger
Age of the domain in days (0 if unknown).
security_checks → domain_age_in_monthsinteger
Age of the domain in months (0 if unknown).
security_checks → domain_age_in_yearsinteger
Age of the domain in years (0 if unknown).
security_checks → is_ecommerce_platformboolean
Returns true if the website is using an ecommerce platform like Shopify.
security_checks → is_high_discountsboolean
Returns true if the website is offering high discounts.
security_checks → is_fake_socialsboolean
Returns true if the website is using fake social profiles.
security_checks → is_heuristic_patternboolean
Returns true if our heuristic engine detected malicious patterns.
security_checks → is_free_emailboolean
Returns true if website is using a free email like Gmail.
security_checks → is_risky_geo_locationboolean
Returns true if website location is considered risky.
security_checks → is_china_countryboolean
Returns true if website is potentially located in China.
security_checks → is_nigeria_countryboolean
Returns true if website is potentially located in Nigeria.
server_details → ipstring
IP address of the submitted host.
server_details → hostnamestring
Reverse DNS hostname (PTR record) of the host's IP address. Empty string if none.
server_details → continent_codestring
Continent code (e.g. NA) of where the host's IP address is located.
server_details → continent_namestring
Continent name (e.g. North America) of where the host's IP address is located.
server_details → country_codestring
Country code (e.g. CN) of where the host's IP address is located.
server_details → country_namestring
Country name of where the host's IP address is located.
server_details → region_namestring
Region or state name of where the host's IP address is located.
server_details → city_namestring
City name of where the host's IP address is located.
server_details → latitudefloat
Approximate latitude of the host's IP address.
server_details → longitudefloat
Approximate longitude of the host's IP address.
server_details → ispstring
Internet Service Provider (ISP) of host's IP address.
server_details → asnstring
IP Autonomous System Number (ASN), such as AS16509.
trust_score → resultinteger
Returns trust score, a number between 0 (bad) and 100 (good).
url_parts → schemestring
URL scheme: http or https.
url_parts → hoststring
Full hostname including subdomain (e.g. www.example.com).
url_parts → host_nowwwstring
Hostname with the www. prefix stripped.
url_parts → portinteger
Port number. Typically 80 for HTTP, 443 for HTTPS, or 0 if unspecified.
url_parts → pathstring
URL path component (e.g. /contact-us/).
url_parts → querystring
URL query string. Empty string if none.
elapsed_msinteger
Time taken to process the request, in milliseconds.