Grade a site's security headers

Codefragmenten

curl "https://api.oanor.com/secheaders-api/v1/analyze" \
  -H "x-oanor-key: oanor_test_..."

await fetch("https://api.oanor.com/secheaders-api/v1/analyze", {
  headers: { "x-oanor-key": "oanor_test_..." }
});

$ch = curl_init("https://api.oanor.com/secheaders-api/v1/analyze");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["x-oanor-key: oanor_test_..."]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$out = curl_exec($ch);

import requests
requests.get(
    "https://api.oanor.com/secheaders-api/v1/analyze",
    headers={"x-oanor-key": "oanor_test_..."}
)

Voorbeeldrespons

Een echte respons van dit endpoint, vastgelegd bij de laatste health check.

{
    "data": {
        "url": "https://example.com/",
        "grade": "F",
        "score": 0,
        "status": 200,
        "missing": [
            {
                "advice": "Enforce HTTPS with HSTS (e.g. max-age=31536000; includeSubDomains).",
                "header": "Strict-Transport-Security"
            },
            {
                "advice": "Define a CSP to mitigate XSS and data-injection.",
                "header": "Content-Security-Policy"
            },
            {
                "advice": "Set 'nosniff' to stop MIME-type sniffing.",
                "header": "X-Content-Type-Options"
            },
            {
                "advice": "Set DENY/SAMEORIGIN (or CSP frame-ancestors) to prevent clickjacking.",
                "header": "X-Frame-Options"
            },
            {
                "advice": "Set a Referrer-Policy (e.g. strict-origin-when-cross-origin).",
                "header": "Referrer-Policy"
            },
            {
                "advice": "Restrict powerful features with a Permissions-Policy.",
                "header": "Permissions-Policy"
            },
            {
                "advice": "Set COOP (e.g. same-origin) for cross-origin isolation.",
                "header": "Cross-Origin-Opener-Policy"
            }
        ],
        "percent": 0,
        "present": [],
        "summary": "0/7 key security headers present; grade F (0%)",
        "final_url": "https://example.com/",
        "max_score": 100,
        "information_leaks": [
            {
                "value": "cloudflare",
                "header": "server"
            }
        ]
    },
    "meta": {
        "timestamp": "2026-06-01T23:40:51.289Z",
        "request_id": "585321c3-7e38-4562-a2fc-5b12fc6ce95a"
    },
    "status": "ok",
    "message": "Security headers analyzed",
    "success": true
}