In April 2026 the SecurityHeaders.com API shut down. Care-plan workflows that called it for letter grades went quiet. Spot checks in a browser still work. Continuous checks that fed retainers did not.
What broke
Many freelancers and small agencies wired header grades into monthly client reports. The free scanner page remained. The API path that automation depended on did not.
If your report still says "check SecurityHeaders.com," that step needs a replacement that returns a grade and a fix list on a schedule.
What to look for instead
You need three things in one place:
- A letter grade for headers (and related TLS and DNS findings)
- Platform-specific fix steps (Cloudflare, Nginx, Apache and WordPress hosts)
- A watch that notices when a header regresses after a deploy
A one-off scan is not a care plan. The grade has to move when the site changes.
How we run it
We built Guardr for that gap. Scan a site. Get an A–F grade. Read the findings. Each finding includes a fix for the platform you use. Free covers one site. Every other site is $3.00 per site per month.
API docs live at https://guardr.io/docs/api/ for teams that had scripts on the old SecurityHeaders path.
Migration checklist
- List every client site that still references the old API
- Run a fresh grade on each
- Ship the top finding with a platform snippet
- Turn on a recurring watch so the next regression is yours to catch, not the client's email
Blog guide
Longer write-up: https://guardr.io/blog/securityheaders-api-migration/?utm_source=devto&utm_medium=social&utm_campaign=S1-shapi
We check and watch. We do not claim to fix the site for you. The fix steps are yours to apply.
Top comments (0)