Security Headers Analyzer API

POST https://api.findutils.com/api/tools/security-headers-analyzer/execute

Grade a set of HTTP response headers for security: returns a 0-100 score, a letter grade (A+ to F), a pass/fail/warning summary, and a per-header finding with a recommendation for CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, and the Cross-Origin-* headers. Pass the headers you already have; this tool does not fetch the URL.

Open the tool Try it

Request body

application/json

headers

object required

Response headers as an object of header name → value (case-insensitive), e.g. {"content-security-policy": "default-src 'self'"}. A raw "Name: value" block string (one header per line, as copied from curl -I) is also accepted.
url

string optional

Optional URL the headers came from. Echoed in the result only.

Example arguments

Verified

{
  "headers": {
    "content-security-policy": "default-src 'self'",
    "strict-transport-security": "max-age=31536000",
    "x-content-type-options": "nosniff",
    "x-frame-options": "DENY"
  },
  "url": "https://example.com"
}

curl -X POST https://api.findutils.com/api/tools/security-headers-analyzer/execute \
  -H "Content-Type: application/json" \
  -d '{
    "headers": {
      "content-security-policy": "default-src '\''self'\''",
      "strict-transport-security": "max-age=31536000",
      "x-content-type-options": "nosniff",
      "x-frame-options": "DENY"
    },
    "url": "https://example.com"
  }'

const response = await fetch('https://api.findutils.com/api/tools/security-headers-analyzer/execute', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({"headers":{"content-security-policy":"default-src 'self'","strict-transport-security":"max-age=31536000","x-content-type-options":"nosniff","x-frame-options":"DENY"},"url":"https://example.com"}),
});
const data = await response.json();

import requests

response = requests.post(
    "https://api.findutils.com/api/tools/security-headers-analyzer/execute",
    json={"headers":{"content-security-policy":"default-src 'self'","strict-transport-security":"max-age=31536000","x-content-type-options":"nosniff","x-frame-options":"DENY"},"url":"https://example.com"},
)
data = response.json()

$ch = curl_init('https://api.findutils.com/api/tools/security-headers-analyzer/execute');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
    CURLOPT_POSTFIELDS => '{"headers":{"content-security-policy":"default-src \'self\'","strict-transport-security":"max-age=31536000","x-content-type-options":"nosniff","x-frame-options":"DENY"},"url":"https://example.com"}',
    CURLOPT_RETURNTRANSFER => true,
]);
$data = json_decode(curl_exec($ch), true);

Also an MCP tool

Call security_headers_analyzer from Claude, Cursor or any MCP client. Same arguments, same output.

https://mcp.findutils.com

MCP reference

Rate limit: 60 a minute, per IP
Auth: None
REST id: security-headers-analyzer
MCP name: security_headers_analyzer
Category: Network
Machine-readable: openapi.json · markdown.md

Request body

Example arguments

More Network tools

More to explore