SecurityHeaders.com API alternative: drop-in grades that keep watching
Replace the SecurityHeaders.com API with a free grade check that keeps watching your client sites. Curl examples for the public GET and keyed POST included.
The short version - the SecurityHeaders.com API shut down in April 2026. The web scanner at securityheaders.com is still live. Those are two different things. Most pages that come up for this query blur them together, which is probably why you are reading a third one.
If you only ever pasted a URL into the box on the website, nothing about your day has changed. If a script called the API on a schedule, that is the half you have to replace.
Guardr is a drop-in for the programmatic half: one HTTP call per domain, a letter grade and a score in the JSON response body, fix instructions attached to every finding and a watch that keeps running between your calls. The first call is one line of curl with no account.
What is covered
- What changed at SecurityHeaders.com
- A note on sourcing
- The web scanner is still live
- What a drop-in replacement has to do
- The grade comes back in the JSON body
- A public check with one curl command
- A keyed POST for a fresh scan
- Watching client sites after the migration
- What it costs
- Fix guides for the three headers people miss
- Agents and the MCP endpoint
- Frequently asked questions
What changed at SecurityHeaders.com
SecurityHeaders.com has been grading HTTP response headers for years. The grading is still the one most people in this field know by sight. None of what follows is a criticism of the tool or of anybody who has ever run it. Ownership moved over the years: the tool came from Scott Helme, Probely absorbed it, then Snyk acquired Probely. Under that ownership the paid programmatic API was discontinued.
The part that matters for a running pipeline is narrow. Calls to the old API endpoint no longer come back with a grade, so everything built on top of them stopped at the same moment: CI gates that failed a build on a header regression, weekly audits across a client estate, JSON filed as compliance evidence, internal dashboards.
A note on sourcing
This page puts the shutdown at April 2026. Here is where that comes from.
The vendor says it plainly. The API page at securityheaders.com/api carries the notice “This service has been discontinued. We are no longer providing new subscriptions or renewing existing subscriptions.” That page is the source for the discontinuation itself. It does not print a date. If that page and this one ever disagree, the vendor is right.
The date comes from the timeline we keep on our own site. Our SecurityHeaders.com API migration post lists every step, from the paid API launch in January 2023 through the change of ownership to the shutdown in April 2026. Read it if you want the sequence rather than the summary.
The web scanner is still live
You can still paste a URL into securityheaders.com today and get a letter grade back. Nothing here asks you to stop. For a one-off look at one URL it is fast, free and good at its job.
What a web form cannot do is answer a script. There is no JSON, no scheduling, no history and no alert when a Friday deployment drops a header. That is the gap this page is about.
What a drop-in replacement has to do
Before comparing anything, it is worth writing down what the old API actually gave you:
- One HTTP call per domain. A GET with the domain in the request. JSON out.
- A letter grade you can compare. The same scale every time, so this week’s answer means something next to last week’s.
- A free tier for automated use. Enough headroom to run a check from a shell or a small script without a purchase order.
- Something a CI job can gate on. A grade or a score in a field a script can read without parsing HTML.
Guardr covers all four. The mapping from the old call to the new one is short:
| Old SecurityHeaders.com API | Guardr /v1 | |
|---|---|---|
| Read a result | GET api.securityheaders.com/?q=example.com | GET api.guardr.io/v1/scan/example.com |
| Auth header | x-api-key | X-API-Key |
| Domain passed as | a query parameter | a path segment |
| Without a key | not available | 5 requests per day per IP |
The grade comes back in the JSON body
This is the one thing to change in a ported script. Guardr does not set an X-Grade response header. The response headers carry rate limit counters and nothing else. The grade, the score and every finding are fields in the JSON body:
{
"domain": "example.com",
"scanned_at": "2026-04-18T10:00:00.000Z",
"grade": "B+",
"score": 83,
"categories": {
"tls": 90,
"headers": 78,
"cookies": 100,
"dns": 80,
"exposure": 100
}
}Reading the grade in a shell is one pipe:
curl -s https://api.guardr.io/v1/scan/example.com | jq -r ".grade"A release gate is the same shape. Read .score, compare it against your floor, exit non-zero when it falls through.
A public check with one curl command
No key, no account, no sign-up:
curl https://api.guardr.io/v1/scan/example.comThat returns the most recent cached scan: the domain, the timestamp, the grade, the score and the five category scores shown above. It is limited to 5 requests per day per IP, which is plenty for a spot check from a shell or a read-only script. The same check runs in the browser on the Guardr home page if you would rather paste a URL than type curl.
A keyed POST for a fresh scan
The public GET hands back what was scanned last. When you need the scan to run right now - straight after a deploy, inside a release gate - POST it with a key:
curl -X POST https://api.guardr.io/v1/scan \
-H "X-API-Key: your_key_here" \
-H "Content-Type: application/json" \
-d '{"domain": "example.com"}'An API key comes with every plan including Free. The keyed response carries the full finding list: what is wrong, how much work the fix is and a configuration snippet per platform for Cloudflare, Nginx and Apache. The field-by-field reference lives in the REST API documentation.
Watching client sites after the migration
A replacement endpoint gets the pipeline running again. It does not touch the older problem underneath it: a check that runs only when somebody remembers to run it is a spot check rather than a monitor.
Guardr keeps watch on a schedule and tells you when the answer changes. Grade drops, downtime, recovery and certificate expiry each raise an alert. Every scan is kept as history, so “when did the Content-Security-Policy header disappear” has an answer rather than a guess.
For an agency the practical shape is this: one account, every client domain inside it, one alert when a deployment on any of them drops a header. The morning a release wipes Strict-Transport-Security off a client site, you hear it from Guardr rather than from the client.
What it costs
- Free - one site - $0.
- All sites - $3.00 per site per month.
That is the whole price list. There are no other tiers. Add or remove sites whenever you like: the bill follows the count. Both plans include the REST API and the MCP endpoint, so moving off the old API costs nothing to try.
Fix guides for the three headers people miss
If your first grade came back lower than you expected, these are the three headers worth reading about first. Each guide carries copy-paste configuration for Cloudflare, Nginx and Apache:
- How to fix a missing Content-Security-Policy header - the one that takes planning rather than a single line.
- How to fix a missing HSTS header -
Strict-Transport-Security, including the subdomain rollout trap. - How to fix a missing X-Frame-Options header - one line, unless you frame your own pages on purpose.
Agents and the MCP endpoint
If the caller is a coding agent rather than a CI job, skip the REST layer. Guardr answers the Model Context Protocol at https://api.guardr.io/mcp, with the same API key as /v1. There are three tools:
check_site- scan a domain and return the grade with its findings.list_sites- list the sites on the account.get_site- read one site in detail.
Setup is on the MCP documentation page and the wider picture for agent workflows is on the agents page. The server is published on Smithery and in the official MCP registry under the name io.guardr/guardr.
Frequently asked questions
Is SecurityHeaders.com gone?
No. The free web scanner is still live at securityheaders.com. The programmatic API is the part that is no longer available, which is why a browser check still works while your script does not.
Does Guardr return the grade in a response header?
No. The grade is the grade field in the JSON body, next to score and the category breakdown. Response headers carry rate limit counters only.
Do I need an account to call the Guardr API?
Not for the public GET. curl https://api.guardr.io/v1/scan/example.com works with no key, at 5 requests per day per IP. A key, which the Free plan includes, unlocks the POST that forces a fresh scan plus the full finding list with its fixes.
Is the grading identical to SecurityHeaders.com?
No. Claiming otherwise would be dishonest. Guardr grades the security headers family alongside TLS, cookies, DNS and exposure paths, so the letter can differ from a headers-only grade on the same site. What carries across is the shape: one scale, A to F, compared week over week.
What does replacing the old API cost?
Free for one site. $3.00 per site per month for all sites. The REST API and the MCP endpoint are on both.
Can my agent run the check for me?
Yes. The MCP endpoint is live at https://api.guardr.io/mcp with check_site, list_sites and get_site, authenticated with the same key as the REST API.
The migration itself is one line in most pipelines: swap the old endpoint for https://api.guardr.io/v1/scan/<domain> then read .grade out of the JSON body instead of a response header. Everything after that - the watch, the alerts, the history - is the part the old API never did.