Six response headers stop whole classes of attack - XSS, clickjacking, protocol downgrade - and most of them are one line of config. See your grade and exactly what to add. No signup.
The same check, as an endpoint - handy if a pipeline previously called the securityheaders.com API (retiring April 2026). Rate-limited per IP; be gentle.
curl -s "https://alertkick.com/api/tools/security-headers?url=example.com"
# => {"grade":"A","score":85,"checks":[...],"finalUrl":"https://example.com/"}
# fail a CI job below B:
GRADE=$(curl -s "https://alertkick.com/api/tools/security-headers?url=example.com" | jq -r .grade)
case "$GRADE" in A+|A|B) echo ok;; *) echo "grade $GRADE"; exit 1;; esac
The grade weights six headers by impact: Strict-Transport-Security and Content-Security-Policy carry the most (25 points each - they stop protocol downgrade and XSS respectively), then X-Content-Type-Options and frame protection (15 each), then Referrer-Policy and Permissions-Policy (10 each). Deprecated headers like X-XSS-Protection are reported but not graded. The check follows redirects (validating every hop) and grades the final destination - the page your users actually receive.
The usual story isn't "we never set headers" - it's "we set them in 2024, then a reverse-proxy change, a CDN migration, or a new ingress quietly dropped them, and nobody noticed because nothing broke." Headers only announce their absence during an incident. That's a monitoring problem: check the grade in CI with the API above, or put a monitor on the things that should never change.
AlertKick watches uptime, certificates, and - with the agent - logins, file changes, and processes at the kernel. The free tier covers 10 monitors, no card, commercial use welcome.
Start watching - free