securityheaders api is dead. this is the curl i use now
Description
The securityheaders.com API is no longer accepting new API keys and is effectively deprecated. Users are advised to switch to an alternative API provided by https://httpsornot.com, which offers similar functionality for checking HTTP security headers with a rate limit of 120 requests per hour per IP without requiring an API key. The new API uses a different JSON response format and grading system. This change does not represent a security vulnerability but rather a service discontinuation and migration notice.
Reddit Discussion
api.securityheaders.com does not take new keys. the website is still there if you only want to look at a grade.
curl -fsS "https://httpsornot.com/api/v1/check?domain=example.com&headersMinGrade=B" no key. 120 requests an hour per IP. GitHub Actions runners share IPs, so that limit shows up fast. a free key goes in X-API-Key if you need more.
422 means the header grade missed B.
429 means the rate limit. different things.
the JSON is not the old securityheaders shape. the header grade is .securityHeaders.grade.
the checker is mine.
Links cited in this discussion
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The original securityheaders.com API has ceased issuing new API keys, limiting its usability for automated security header checks. An alternative API at https://httpsornot.com provides similar functionality without requiring an API key for up to 120 requests per hour per IP address. The new API returns JSON data with a different structure and grading scheme. Rate limiting and response codes differ from the original API, with 422 indicating a header grade below B and 429 indicating rate limiting. This is a service change announcement rather than a software vulnerability or exploit.
Potential Impact
There is no direct security impact or vulnerability disclosed. The main effect is that users relying on the securityheaders.com API for automated security header assessments must migrate to the new httpsornot.com API or find alternative solutions. Failure to do so may disrupt automated security header scanning workflows.
Defensive Guidance
No security remediation is required. Users should update their tooling and scripts to use the httpsornot.com API endpoint as described, respecting the new rate limits and response codes. No action is needed for security vulnerabilities since none are reported.
Technical Details
- Source Type
- Subreddit
- cybersecurity
- Reddit Score
- 0
- Discussion Level
- minimal
- Content Source
- reddit_link_post
- Post Type
- link
- Newsworthiness Assessment
- {"score":27,"reasons":["external_link","established_author","very_recent"],"isNewsworthy":true}
- Has External Source
- true
- Trusted Domain
- false
Threat ID: 6adb37364d27ba8daaf9330e
Added to database: 10/23/2026, 10:30:14 UTC
Last enriched: 10/23/2026, 10:30:56 UTC
Last updated: 10/23/2026, 15:35:05 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.