Website Security Analyzer

Perform a bounded, non-invasive security and HTTPS configuration analysis of one public website URL.

cURL example

curl --request POST \
  --header "Authorization: Bearer {serviceTokenHere}" \
  "https://ai.mihajlo.mk/api/website-security-analyzer-api/v1/analyze-website"

Example response

{
    "url": "https://example.com/",
    "final_url": "https://example.com/",
    "score": 82,
    "grade": "B",
    "https": {
        "enabled": true,
        "http_redirect": true,
        "redirects_to_https": true
    },
    "tls": {
        "valid": true,
        "hostname_valid": true,
        "issuer": "Example Certificate Authority",
        "subject": "example.com",
        "expires_at": "2026-10-14T12:00:00Z",
        "days_remaining": 64,
        "protocol": "TLSv1.3"
    },
    "security_headers": {
        "strict_transport_security": {
            "present": true,
            "secure": true,
            "value": "max-age=31536000; includeSubDomains"
        },
        "content_security_policy": {
            "present": true,
            "secure": true,
            "value": "default-src 'self'"
        }
    },
    "cookies": {
        "count": 1,
        "secure_count": 1,
        "http_only_count": 1,
        "same_site_count": 1,
        "items": [
            {
                "name": "session",
                "secure": true,
                "http_only": true,
                "same_site": "Lax"
            }
        ]
    },
    "mixed_content": {
        "detected": false,
        "count": 0,
        "insecure_resources": []
    },
    "exposed_headers": [],
    "cors": {
        "allow_origin": null,
        "allow_credentials": false,
        "permissive": false
    },
    "security_txt": {
        "available": true,
        "url": "https://example.com/.well-known/security.txt",
        "status": 200,
        "has_contact": true
    },
    "issues": {
        "critical": [],
        "high": [],
        "medium": [],
        "low": [
            {
                "code": "software-header-exposed",
                "title": "Software details are exposed",
                "evidence": "The Server header reveals implementation details.",
                "recommendation": "Remove or generalize software-identifying response headers."
            }
        ],
        "info": []
    },
    "recommendations": [
        "Remove or generalize software-identifying response headers."
    ]
}