SecurityHeaders.com API Discontinued — Migrate Your CI in Minutes

August 19, 2026

After the Snyk / Probely acquisitions, the programmatic SecurityHeaders.com API (api.securityheaders.com) was discontinued in April 2026. The free web scanner may still work for manual checks; CI jobs and scripts that called the API do not. This post is the long-tail migration path — for pipelines that fail months later when a cached key or URL finally breaks.

Key takeaways

Web UI ≠ API. Only the programmatic endpoint went away.
Closest CI gate on httpsornot: headersMinGrade → HTTP 422 on fail (same idea as fail-the-PR on a letter grade).
Not a fake 1:1 X-Grade drop-in — assert on securityHeaders.grade, not composite sslGrade, unless you pin gradingVersion.
CI alone is not enough — monitor for silent header drops after deploy.

One-line replacement

# before (gone)
curl -sS -H "x-api-key: …" "https://api.securityheaders.com/?q=example.com"

# after — free, no key; fail closed with curl -f
curl -fsS "https://httpsornot.com/api/v1/check?domain=example.com&headersMinGrade=B"

Full field map and jq extract: SecurityHeaders.com alternative — API migration.

GitHub Actions (copy-paste)

name: Security headers (httpsornot)
on:
  push:
  schedule:
    - cron: "0 8 * * 1"   # weekly smoke

jobs:
  headers:
    runs-on: ubuntu-latest
    steps:
      - name: Fail if headers grade below B
        env:
          DOMAIN: example.com   # ← change this
        run: |
          set -euo pipefail
          # One check per job — public API is 120 req/hour/IP; GHA runners share egress IPs.
          # Optional: create a free account, Dashboard → API keys, then:
          #   -H "X-API-Key: hsn_…"
          # headersMinGrade: A+|A|B|C|D|F (not sslGrade A-/B+).
          # Policy fail / bot block → HTTP 422. Our rate limit → 429 (different!).
          curl -fsS \
            "https://httpsornot.com/api/v1/check?domain=${DOMAIN}&headersMinGrade=B" \
            -o result.json
          jq '{ grade: .securityHeaders.grade, policyOk, gradingVersion: .sslGrade.gradingVersion }' result.json
          # Optional composite HTTPS gate:
          # curl -fsS "https://httpsornot.com/api/v1/check?domain=${DOMAIN}&minGrade=A-&requireHsts=true"

Prefer this YAML over a Marketplace Action until you need packaging. Details and rate-limit notes: API docs — SecurityHeaders migration.

After CI: watch the domain

Workflows only run when you push. The failure mode that hurts is a CDN or framework change that removes CSP while the site still works — see when a deploy drops CSP. Free monitoring (one domain, weekly) emails on header/grade changes.

Open migration + watch CTA