Website Security Headers Grade (A to F)

{
  "type": "object",
  "required": [
    "url"
  ],
  "properties": {
    "url": {
      "type": "string",
      "pattern": "^https?://\\S+$",
      "examples": [
        "https://example.com"
      ],
      "maxLength": 2048,
      "description": "The full address of the page to check, starting with https:// or http://."
    }
  },
  "additionalProperties": false
}

{
  "type": "object",
  "properties": {
    "grade": {
      "type": "string",
      "description": "Letter grade from A (best) to F (worst)."
    },
    "score": {
      "type": "number",
      "description": "Score from 0 to 100; higher is better."
    },
    "server": {
      "type": "string",
      "description": "The page's Server header value."
    },
    "missing": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "header": {
            "type": "string",
            "description": "Header name, in lower case."
          },
          "severity": {
            "type": "string",
            "description": "'high' or 'medium'."
          },
          "recommendation": {
            "type": "string",
            "description": "How to add the header."
          }
        }
      },
      "description": "Security headers the page does not send."
    },
    "present": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "value": {
            "type": "string",
            "description": "The header's value as sent."
          },
          "header": {
            "type": "string",
            "description": "Header name, in lower case."
          },
          "status": {
            "type": "string",
            "description": "'present', or a note such as 'present (deprecated header)'."
          }
        }
      },
      "description": "Security headers the page sends."
    },
    "response_status": {
      "type": "number",
      "description": "The HTTP status code of the response."
    }
  },
  "description": "The security-header grade of the page."
}