How to Grade a Website’s Security Headers From Code (A+ to F)

Follow the steps below and use the linked tools and references as you go.

Evidence trail: Security Headers Grader API on RapidAPI · Web Content & URL Tools MCP Server on Apify

Security headers are easy to forget and easy to check. One GET request returns a grade, a score out of 100 and the list of headers that are missing.

Subscribe to the free plan on RapidAPI, then call the endpoint with your RapidAPI key:

curl -G 'https://security-headers-grader.p.rapidapi.com/v1/security-headers' \
  --data-urlencode 'url=https://www.mozilla.org/' \
  -H 'x-rapidapi-host: security-headers-grader.p.rapidapi.com' \
  -H 'x-rapidapi-key: YOUR_RAPIDAPI_KEY'

We ran this exact call against mozilla.org while writing this post. The key fields of the real response:

{
  "grade": "A",
  "score": 85,
  "https": true,
  "missing": [
    "permissions-policy",
    "cross-origin-resource-policy"
  ]
}

import requests

resp = requests.get(
    'https://security-headers-grader.p.rapidapi.com/v1/security-headers',
    params={'url': 'https://www.mozilla.org/'},
    headers={'x-rapidapi-host': 'security-headers-grader.p.rapidapi.com', 'x-rapidapi-key': 'YOUR_RAPIDAPI_KEY'},
    timeout=30,
)
resp.raise_for_status()
print(resp.json())

• Check a site before launch, or after a CDN or hosting change.
• Run it in CI so a deploy that drops a header fails loudly.
• Audit many client sites with the same yardstick.

• It grades the response headers of one page; other pages on the site can differ.
• A good grade is a baseline, not a security review: it says nothing about the application itself.

The same endpoint is one of the tools in the Web Content & URL Tools MCP Server on Apify. Point any client that supports remote MCP servers at `https://avalonai–web-content-url-tools-mcp.apify.actor/mcp` with your Apify token (`YOUR_APIFY_TOKEN`) and the agent can call it directly: https://apify.com/avalonai/web-content-url-tools-mcp

Security Headers Grader API on RapidAPI (free plan available): https://rapidapi.com/avalonai/api/security-headers-grader

Our APIs on RapidAPI: https://rapidapi.com/user/avalonai

• Security Headers Grader API — produced the example response in this tutorial (run against mozilla.org): https://rapidapi.com/avalonai/api/security-headers-grader