Low Severity
Published: Nov 7, 2026
Website Security Scanner API — passive security audit with a 0–100 score & grade, live CVE intelligence, and Nuclei-powered deep scans. By hhelll.
# Website Security Scanner API
   
Scan any public website's security posture in seconds — completely passively, with nothing installed on the target: HTTPS enforcement and TLS health, security headers, cookie flags, server information disclosure, exposed files such as `.env` and `.git`, mixed content, DNS and email authentication checks, Certificate Transparency subdomain surface, scan-to-scan change diffs, and outdated software matched against live CVE intelligence (EPSS exploit probability and CISA KEV active-exploitation data) — all rolled into one 0–100 score and a letter grade.
*This repository previously catalogued the dev-utility APIs family; it now documents a single API — the Website Security Scanner API.*
**Live on RapidAPI → [Website Security Scanner API](https://rapidapi.com/Hitler-HlDevZDwP/api/website-security-scanner-api)**
**Try it free, no signup → [scan.hhelll.my.id](https://scan.hhelll.my.id/)** — the official live scanner: score, grade, per-category pass/fail and findings, the same shape the free BASIC plan returns.
### What it does
Give the API a URL and it runs a full passive audit: it follows the redirect chain, inspects the TLS certificate and protocol support, checks six security headers and cookie flags, fingerprints the technology stack and matches detected versions against live CVE data, enriched with EPSS scores and CISA KEV status, probes a short list of commonly exposed files, and looks for mixed content. It also checks DNS and email authentication (SPF, DMARC, DKIM selectors, and CAA), looks for a published security.txt and HSTS preload status, maps the Certif