For developers and AI assistants

Resources

• /llms.txt — short description for AI assistants
• /openapi.json — OpenAPI 3.1 description of the grade API
• /methodology — checks, weights and how the score is calculated
• /api/grade?domain=example.com — read-only JSON grade

Example

{
  "domain": "example.com",
  "grade": "D",
  "score": 64,
  "scanned_at": "2026-11-05T14:00:00.000Z",
  "scoring_version": 2,
  "issues": [
    {
      "id": "hsts",
      "title": "Tell browsers to always use the secure version",
      "severity": "medium",
      "status": "fail"
    },
    {
      "id": "csp",
      "title": "Limit what scripts your pages are allowed to run",
      "severity": "medium",
      "status": "fail"
    }
  ],
  "what_to_do_first": [
    {
      "id": "hsts",
      "title": "Tell browsers to always use the secure version",
      "why": "Helps browsers use HTTPS on future visits after they have received the policy.",
      "who_can_fix": "Your web host",
      "verify": "curl -sIL https://example.com/ | grep -i \"Strict-Transport-Security\""
    }
  ],
  "coverage": {
    "state": "partial",
    "assessed_weight": 95,
    "eligible_weight": 100,
    "ratio": 0.95
  },
  "excluded": [
    {
      "id": "dkim",
      "title": "DKIM — digital signature on email",
      "reason": "unverified"
    }
  ],
  "report_url": "https://getmirror.online/report/example.com",
  "methodology_url": "https://getmirror.online/methodology",
  "limitations": "Passive check of public configuration only (DNS, email authentication records, HTTPS and HTTP response headers of the homepage). It is not a penetration test, does not test the application, and a good grade is not a security guarantee."
}

Illustrative response. Limit: 10 requests per minute per client; results are cached per domain for up to 10 minutes. Only public domain names are accepted.