Site Health

Probes a domain's homepage, robots.txt and sitemap.xml at request time and reports transport and header hygiene: whether plain HTTP redirects to HTTPS, whether HSTS is set, how www. behaves, which security headers the homepage sends, and what robots.txt declares. This is a live check, not link graph data.

Request

Parameters

Example

curl "https://api.rankparse.com/v1/site-health?domain=stripe.com" \
  -H "X-API-Key: rp_your_key"

import requests

resp = requests.get(
    "https://api.rankparse.com/v1/site-health",
    params={"domain": "stripe.com"},
    headers={"X-API-Key": "rp_your_key"},
    timeout=30,
)
resp.raise_for_status()
health = resp.json()["data"]
print(health["https"], health["security_headers"])

const res = await fetch(
  "https://api.rankparse.com/v1/site-health?domain=stripe.com",
  { headers: { "X-API-Key": process.env.RANKPARSE_API_KEY } }
);
if (!res.ok) throw new Error(`${res.status}: ${await res.text()}`);
const { data } = await res.json();
console.log(data.https, data.security_headers);

Response

{
  "domain": "stripe.com",
  "data": {
    "domain": "stripe.com",
    "https": {
      "enforced": true,
      "hsts": true,
      "hsts_max_age": 31536000
    },
    "www_redirect": { "enabled": false, "target": null },
    "checks": [
      { "url": "https://stripe.com/", "status": 200, "content_type": "text/html", "response_time_ms": 180 },
      { "url": "https://stripe.com/robots.txt", "status": 200, "content_type": "text/plain", "response_time_ms": 95 },
      { "url": "https://stripe.com/sitemap.xml", "status": 200, "content_type": "application/xml", "response_time_ms": 112 }
    ],
    "security_headers": {
      "x_frame_options": "SAMEORIGIN",
      "x_content_type_options": "nosniff",
      "content_security_policy": true,
      "strict_transport_security": "max-age=31536000; includeSubDomains",
      "referrer_policy": "strict-origin-when-cross-origin"
    },
    "robots_txt": {
      "present": true,
      "disallow_all": false,
      "sitemap_declared": true
    }
  },
  "credits_used": 2,
  "credits_remaining": 998
}

Response fields

Behavior and limits

• What is fetched. One full GET of the HTTPS homepage (8 second timeout, 2 MB cap, up to 5 redirects), HEAD requests for /robots.txt, /sitemap.xml, the plain http:// homepage and https://www.<domain>/ (5 seconds each), and, when robots.txt returns 200, a GET of its body. Security headers and HSTS come from the homepage response.
• Optional probes degrade quietly. If the robots.txt, sitemap.xml, HTTP or www probe fails or times out, the rest of the report is still returned. A failed checks entry has status, content_type and response_time_ms all null. A failed HTTP probe shows https.enforced: false.
• HEAD quirks. Some servers answer HEAD differently from GET (for example 405). checks reports what the HEAD request received.
• Required probe. The HTTPS homepage fetch is required. If it fails, the whole call fails with an error and is refunded.
• Billing. Costs 2 credits; refunded automatically on any non-2xx response. Malformed or private domains are rejected before billing. Subject to the standard 60 requests per minute limit.

Errors

See Errors for the shared error format.

Related

MCP tool: get_site_health.