---
title: "Analyze live HTTP security headers"
method: GET
path: "/security-headers/analyze"
tags: ["web"]
---

# Analyze live HTTP security headers

`GET /security-headers/analyze`

## Request

- Base URL: `https://intodns.ai/api`
- URL: `https://intodns.ai/api/security-headers/analyze`
- Auth: none required

Fetch a domain's live HTTP security headers (Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy), report per-header pass/missing status, and return the recommended baseline config with ready-to-paste fixes. If the header fetch times out, every status is reported as 'unknown' instead of 'missing'.

## Query parameters

- `domain` string, required

## Response `200`

Security headers analysis result

- SecurityHeadersAnalyzeResult
  - `domain` string
  - `scannedAt` string, date-time
  - `httpsAvailable` boolean
  - `headerFetchTimedOut` boolean: When true, header absence could not be verified — every status is 'unknown' and a note is set
  - `note` string: Present only when the header fetch timed out
  - `current` object[]
    - `name` string
    - `present` boolean
    - `value` string, nullable
    - `status` 'pass' | 'missing' | 'unknown'
  - `missing` string[]: Header names confidently missing (empty when the fetch timed out)
  - `recommended` object: The recommended baseline security-headers config
  - `outputs` object: Ready-to-paste recommended configuration per server format
  - `warnings` string[]

## Other responses

- `400`: Invalid or missing domain

---

[API](https://skmtc.dev/intodns/apis/intodns-ai-api.md) · [All operations](https://skmtc.dev/intodns/apis/intodns-ai-api/llms.txt) · [OpenAPI document](https://skmtc.dev/intodns/apis/intodns-ai-api/revisions/c6c196b2fb4c?raw)