SecurityHeaders.com Alternative
SecurityHeaders.com popularized header grading. After the Snyk acquisition its programmatic API was discontinued in April 2026 (the free web scanner may still work for manual checks). HTTPS Checker scans the same six headers as part of a full HTTPS report — and can watch your domain so a deploy that drops CSP does not go unnoticed.
Replacing api.securityheaders.com in CI? Jump to the API migration guide · Watch for header regressions.
Enter any domain — headers, grade, certificate and redirects in seconds.
HTTPS Checker vs SecurityHeaders.com
| Feature | HTTPS Checker | SecurityHeaders.com |
|---|---|---|
| Security headers scan (HSTS, CSP, X-Frame-Options, …) | Yes | Yes |
| Letter grade (A+ to F) | Yes | Yes |
| Continuous monitoring with email alerts on changes | Yes | No |
| SSL certificate, expiry & TLS versions in the same report | Yes | No |
| HTTP → HTTPS redirect chain | Yes | No |
| HTTP/2 & HTTP/3 (QUIC) | Yes | No |
| Certificate Transparency alerts (new cert issued) | Paid plans | No |
| Bulk check | Up to 10 domains | No |
| Public JSON API | Yes | Discontinued April 2026 |
| PDF / JSON export | Yes | No |
Migrate from the SecurityHeaders.com API
Stable public endpoint (no API key required): https://httpsornot.com/api/v1/check?domain=example.com. Rate limit: 120 requests / hour / IP (GitHub Actions often share egress IPs; optional account API keys avoid that shared bucket). Full contract: API docs / OpenAPI.
Not a 1:1 grade drop-in. Their X-Grade was headers-only. Our sslGrade is a composite HTTPS score (redirect, certificate, TLS, HSTS, headers, …) published with gradingVersion. For a CI gate closest to the old tool, assert on securityHeaders.grade. If you gate on sslGrade.grade, pin sslGrade.gradingVersion and read the grading methodology.
Before / after
Before (no longer available):
curl -sS "https://api.securityheaders.com/?q=example.com"
After — full porcelain JSON:
curl -sS "https://httpsornot.com/api/v1/check?domain=example.com"
Headers-focused extract (closest to the old response shape):
curl -sS "https://httpsornot.com/api/v1/check?domain=example.com" \
| jq '{ grade: .securityHeaders.grade, headers: .securityHeaders.headers, gradingVersion: .sslGrade.gradingVersion }'Field mapping
| SecurityHeaders.com | httpsornot | Notes |
|---|---|---|
| `X-Grade` response header / overall letter | `securityHeaders.grade` | Closest match — headers-only A+–F. Not the same as `sslGrade.grade`. CI: `headersMinGrade`. |
| `strict-transport-security` | `securityHeaders.headers[]` where `name` is `"HSTS"` | `present`, optional `value`, `weakValue` when max-age=0. CI: `requireHsts=true`. |
| `content-security-policy` | `… name` `"CSP"` | Required for our security-headers factor and for composite A+. |
| `x-frame-options` | `… name` `"X-Frame-Options"` | — |
| `x-content-type-options` | `… name` `"X-Content-Type-Options"` | Only `nosniff` counts as present. |
| `referrer-policy` | `… name` `"Referrer-Policy"` | Last recognised token; `no-referrer-when-downgrade` is weak. |
| `permissions-policy` / Feature-Policy | `… name` `"Permissions-Policy"` | — |
| (none — headers scanner only) | `sslGrade` + `sslGrade.gradingVersion` | Composite HTTPS score. CI: `minGrade=A-` (sslGrade scale). Pin `gradingVersion` in methodology. |
| (none) | `botProtectionBlocked` | True when a CDN challenge blocked us — grade withheld. With policy params → HTTP 422. |
GitHub Actions workflow (copy-paste)
Paste into .github/workflows/security-headers.yml. Set DOMAIN to your host. Uses headersMinGrade so you do not fail PRs on unrelated TLS/redirect scoring. No Marketplace Action required — this YAML is the supported path.
name: Security headers (httpsornot)
on:
push:
schedule:
- cron: "0 8 * * 1" # weekly smoke
jobs:
headers:
runs-on: ubuntu-latest
steps:
- name: Fail if headers grade below B
env:
DOMAIN: example.com # ← change this
run: |
set -euo pipefail
# One check per job — public API is 120 req/hour/IP; GHA runners share egress IPs.
# Optional: create a free account, Dashboard → API keys, then:
# -H "X-API-Key: hsn_…"
# headersMinGrade: A+|A|B|C|D|F (not sslGrade A-/B+).
# Policy fail / bot block → HTTP 422. Our rate limit → 429 (different!).
curl -fsS \
"https://httpsornot.com/api/v1/check?domain=${DOMAIN}&headersMinGrade=B" \
-o result.json
jq '{ grade: .securityHeaders.grade, policyOk, gradingVersion: .sslGrade.gradingVersion }' result.json
# Optional composite HTTPS gate:
# curl -fsS "https://httpsornot.com/api/v1/check?domain=${DOMAIN}&minGrade=A-&requireHsts=true"CI catches the PR — monitoring catches the silent deploy
A workflow only runs when you push. The classic failure is a CDN or framework change that drops CSP or HSTS while the site still loads. Free weekly monitoring (one domain) emails you when headers or grade change — paid plans add daily checks, Slack/webhooks, and Certificate Transparency.
Alerts on regressions
A framework update removes your CSP, a CDN change drops HSTS — your site keeps working, so nobody notices. Monitoring emails you when any of the six headers appears or disappears, or your grade drops.
More than headers
The same report covers the SSL certificate and expiry, TLS versions, redirect chain, HTTP/2 and HTTP/3, mixed content, CAA and DNSSEC — one grade for your whole HTTPS setup. Paid plans add Certificate Transparency alerts when anyone issues a certificate for your domain.
API migration
Field map, curl, and a CI snippet are in the migration section. Pin gradingVersion if you assert on the composite grade — see methodology.
Related: