The securityheaders.com API is gone. This is the drop-in.

- GET https://api.securityheaders.com/?q=example.com
+ GET https://myssl.info/headers/check?q=example.com

Same grade scale (A+→F) and the same "Grade capped at A" behaviour for an 'unsafe-inline'/'unsafe-eval' CSP. Compatible JSON (summary.grade, summary.headers, score, testsPassed/Failed, rawHeaders) plus the cap signal, warnings and upcoming-headers list. Try it: /headers/check?q=github.com. New here? See the full securityheaders.com API migration guide →

The JSON mirrors the securityheaders.com report — grade, the cap reason, present/missing/upcoming headers, warnings and the raw response headers:

{
  "grade": "A",
  "score": 90,
  "gradeCapped": true,
  "gradeCapReason": "Grade capped at A because the Content-Security-Policy
                     contains 'unsafe-inline' and 'unsafe-eval' in the
                     script-src directive...",
  "warnings": [
    "Content-Security-Policy contains 'unsafe-inline' in the script-src ...",
    "Content-Security-Policy contains 'unsafe-eval' in the script-src ..."
  ],
  "headersPresent": ["Strict-Transport-Security", "Content-Security-Policy",
                     "X-Frame-Options", "X-Content-Type-Options",
                     "Referrer-Policy", "Permissions-Policy"],
  "headersMissing": [],
  "upcomingHeaders": [
    {"header": "Cross-Origin-Embedder-Policy", "present": false, "description": "..."},
    {"header": "Cross-Origin-Opener-Policy",   "present": false, "description": "..."},
    {"header": "Cross-Origin-Resource-Policy", "present": false, "description": "..."}
  ],
  "summary": { "grade": "A", "site": "myssl.info", "headers": { ... } },
  "rawHeaders": { "Strict-Transport-Security": "max-age=31536000; ...", ... },
  "myssl": { "deeper_score": 93, "advanced": [...], "https_redirect": true }
}

The grade is also returned in the X-Grade response header (and X-Grade-Capped when capped). The myssl block adds our deeper analysis (HTTPS-redirect, cookies, mixed content, security.txt) that the old API never offered — it does not change the headline grade.

• A permanently free tier for basic, on-demand checks.
• If we ever change a public endpoint: a documented successor ships first, with ≥12 months' notice and in-band Deprecation/Sunset headers so headless CI gets warned.
• We're independent and security-focused. We won't strand you the way the tool you came from did.

The anonymous endpoint is rate-limited for occasional checks. For CI volume, scheduled monitoring and grade-drop alerts, create a free account.