sitescanapi.com

We spend countless hours tweaking unit tests, Docker builds, and database indexes. Yet, one of the easiest attack vectors is also the one most teams forget: HTTP defensive security headers.
Without strict headers, your app can leave users exposed to:

  • SSL-Stripping / MitM (missing Strict-Transport-Security with preload)
  • Clickjacking & iFrame hijacking (missing X-Frame-Options)
  • XSS & malicious script injection (missing Content-Security-Policy)
  • Domain spoofing & phishing (unconfigured DNS SPF/DMARC)

To solve this for my own deployment pipelines without dealing with slow web UIs or enterprise sales walls, I built SiteScanAPI
— a passive, edge-powered scanner and zero-auth REST API that audits any domain in under 250 milliseconds.

🛠️ The Problem with Existing Scanners

Most security checkers out there fall into one of two camps:

  1. Interactive-only web tools with no clean, programmatic REST API for automated CI/CD checks.
  2. Heavy vulnerability suites that require accounts, API keys, credit cards, or run intrusive network probing that can trigger firewall bans.

I wanted something lightweight, passive, and instantaneous that could be queried from curl, GitHub Actions, or a monitoring cron job.

⚡ How It Works Under the Hood

The engine runs on globally distributed edge workers (Cloudflare Edge). When an audit request comes in:

  1. Non-Intrusive HTTP Interrogation: Sends standard passive GET/HEAD requests to inspect returned headers without testing invasive payloads.
  2. Strict RFC & W3C Analysis: Evaluates HSTS max-age, CSP directives, Referrer-Policy, and Permissions-Policy against current standards.
  3. Next-Gen Origin Isolation: Checks modern browser boundaries like Cross-Origin-Opener-Policy (COOP) and Cross-Origin-Embedder-Policy (COEP).
  4. Parallel DNS-over-HTTPS (DoH): Resolves and audits SPF and DMARC records to flag email spoofing risks.
  5. Vulnerability Disclosure (RFC 9116): Confirms whether /.well-known/security.txt exists for white-hat reports.
  6. Information Leak Scrape: Flags banner disclosures like Server: Apache/2.4.41 or X-Powered-By: Express.

💻 Try It in 1 Line of Code
No API keys, no registration. Open your terminal:

curl -s "https://sitescanapi.com/api/scan?url=github.com" | jq

Example JSON Response 

{ "target": "github.com", "score": 95, "grade": "A+", "summary": { "passed": 11, "warnings": 1, "failed": 0 }, "checks": [ { "name": "Strict-Transport-Security", "header": "strict-transport-security", "present": true, "status": "pass", "value": "max-age=31536000; includeSubDomains; preload", "recommendation": "Enforces HTTPS connections and preloading." }, { "name": "Content-Security-Policy", "header": "content-security-policy", "present": true, "status": "pass" } ], "dns": { "spf": { "present": true, "status": "pass" }, "dmarc": { "present": true, "status": "pass" } } }

🤖 Automate It in GitHub Actions

You can drop this step into your CI/CD workflow to fail builds if someone pushes a change that degrades your production security posture:

name: Security Perimeter Audit on: deployment_status: jobs: audit-headers: if: github.event.deployment_status.state == 'success' runs-on: ubuntu-latest steps: - name: Audit Production Security Score run: | DOMAIN="yourdomain.com" RESPONSE=$(curl -s "https://sitescanapi.com/api/scan?url=${DOMAIN}") SCORE=$(echo "$RESPONSE" | jq -r '.score') GRADE=$(echo "$RESPONSE" | jq -r '.grade') echo "Perimeter Security Grade: $GRADE ($SCORE/100)" if [ "$SCORE" -lt 80 ]; then echo "❌ Security score below minimum threshold (80). Check missing headers!" exit 1 fi echo "✅ Security headers check passed!"

🔧 2-Minute Quick Fixes

If your site scores below an A, here are the most impactful fixes:

Nginx 

# Add to your server block add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; add_header X-Content-Type-Options "nosniff" always; add_header X-Frame-Options "DENY" always; add_header Referrer-Policy "strict-origin-when-cross-origin" always; add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always; # Strip server banner disclosure server_tokens off;

Cloudflare (_headers file) 

/* Strict-Transport-Security: max-age=31536000; includeSubDomains; preload X-Content-Type-Options: nosniff X-Frame-Options: DENY Referrer-Policy: strict-origin-when-cross-origin Permissions-Policy: camera=(), microphone=(), geolocation=()

🚀 Test Your Domain

You can test any domain live using the web interface or directly via the API:

  • 🌐 Web Dashboard: sitescanapi.com
  • 📡 API Endpoint: https://sitescanapi.com/api/scan?url={domain}

💬 Discussion

What score did your production domain get? What has been your biggest headache when implementing a strict Content Security Policy (CSP)? Drop your domain or thoughts in the comments below!