web

Analyze live HTTP security headers

Fetch a domain's live HTTP security headers (Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy), report per-header pass/missing status, and return the recommended baseline config with ready-to-paste fixes. If the header fetch times out, every status is reported as 'unknown' instead of 'missing'.

get/security-headers/analyze

Request

  • Base URL: https://intodns.ai/api
  • URL: https://intodns.ai/api/security-headers/analyze
  • Auth: none required

Query parameters

domainstring required
Example:example.com

Domain to check

Response

Security headers analysis result

domainstring
scannedAtstring date-time
httpsAvailableboolean
headerFetchTimedOutboolean

When true, header absence could not be verified — every status is 'unknown' and a note is set

notestring

Present only when the header fetch timed out

missingstring[]

Header names confidently missing (empty when the fetch timed out)

recommendedobject

The recommended baseline security-headers config

outputsobject

Ready-to-paste recommended configuration per server format

warningsstring[]

Example response

{
  "current": [
    {
      "name": "Content-Security-Policy"
    }
  ]
}

Changes

No recorded changes to this operation across all 1 revision of this API.