Yes. It's the same endpoint the website uses and requires no signup, no API key, and no rate-limited plan tier. Please cache aggressively on your side.

Do I need an API key?

No. The endpoint is fully public with CORS enabled, so it works from browsers, servers, CI runners, and edge functions without authentication.

How fresh are the results?

Results come from the last full scan of the domain (cached for up to 24 hours). If no scan exists yet, trigger one by visiting /report/{domain} first, then poll the API.

What's the rate limit?

There's no hard rate limit on cached reads. Please be reasonable — one request per domain per hour is more than enough since results only change when you rescan.

Can I use it in production?

Yes. It runs on Cloudflare's edge with sub-second latency for cached reports and identical availability to the main site.

What format is the response?

JSON with the full graded report: overall score, per-category scores (Security, Infrastructure, SEO, Email, Performance, Trust), all module results, findings, and remediation hints.

Public API

Free Website Audit API

The same JSON that powers this website — free, keyless, CORS-enabled, and cached at Cloudflare's edge. Pipe it into CI, dashboards, monitoring, or your own product.

No signup

Public endpoint, no API key or account required.

CORS enabled

Call it directly from the browser, edge, or server.

Cached at the edge

Sub-second reads worldwide. Reports refresh every 24h.

Endpoint

One GET, one path parameter, one JSON response.

GET https://websiteauditor.net/api/public/audit/{domain}

Returns 200 when a cached report exists, 404 if the domain has never been scanned. Trigger a scan by visiting /report/{domain} first.

Quickstart

curl

curl https://websiteauditor.net/api/public/audit/example.com

Browser / fetch

const res = await fetch(
  "https://websiteauditor.net/api/public/audit/example.com"
);
const { ok, cachedAt, report } = await res.json();

console.log(report.grade);        // "A", "B", "C", …
console.log(report.score);        // 0–100
console.log(report.categories);   // per-category scores
console.log(report.modules);      // every check, with details

Node.js — scan on demand + poll

import { setTimeout as delay } from "node:timers/promises";

async function getReport(domain) {
  const url = `https://websiteauditor.net/api/public/audit/${domain}`;
  for (let i = 0; i < 5; i++) {
    const res = await fetch(url);
    if (res.ok) return res.json();
    if (res.status === 404) {
      // No cached report yet — trigger one by hitting the report page,
      // then wait and retry.
      await fetch(`https://websiteauditor.net/report/${domain}`);
      await delay(4000);
      continue;
    }
    throw new Error(`${res.status} ${res.statusText}`);
  }
  throw new Error("No report available");
}

const { report } = await getReport("example.com");
console.log(report.score, report.grade);

Response shape

Every field the report UI shows is available in the JSON. Categories, module-level scores, findings, and remediation hints are all first-class.

{
  "ok": true,
  "cachedAt": 1735689600000,
  "report": {
    "domain": "example.com",
    "score": 82,
    "grade": "A-",
    "categories": {
      "security":    { "score": 88, "grade": "A"  },
      "infrastructure": { "score": 91, "grade": "A" },
      "seo":         { "score": 76, "grade": "B"  },
      "email":       { "score": 84, "grade": "A"  },
      "performance": { "score": 74, "grade": "C"  },
      "trust":       { "score": 100, "grade": "A+" }
    },
    "modules": [
      {
        "id": "hsts",
        "title": "HSTS",
        "status": "pass" | "warn" | "fail",
        "score": 100,
        "details": "...",
        "recommendation": "..."
      }
    ],
    "finalUrl": "https://example.com/",
    "fetchedAt": 1735689600000
  }
}

Common use cases

CI security gate — fail the build if score < 80.
Agency dashboards — track client sites weekly with one call each.
Lead qualification — enrich CRM rows with a real security grade.
Uptime + posture — pair with your monitoring to catch drift in HTTPS, DNS, or headers.

Grade badge

Every scanned domain gets a shareable SVG badge — perfect for READMEs and status pages.

<a href="https://websiteauditor.net/report/example.com">
  <img src="https://websiteauditor.net/badge/example.com.svg" alt="Website Auditor grade" height="28"/>
</a>

Frequently asked questions

Is the API free?: Yes. It's the same endpoint the website uses and requires no signup, no API key, and no rate-limited plan tier. Please cache aggressively on your side.
Do I need an API key?
How fresh are the results?
What's the rate limit?
Can I use it in production?
What format is the response?