# Security badges

> Embed an SVG badge that shows a domain's latest verified Website Security grade, in the default, compact or mini style.

Source: https://docs.vigilbase.com/tools/developers/badges

A security badge is an SVG image that shows a domain's grade from its latest verified [Website Security](https://docs.vigilbase.com/tools/website-security) scan. Add it to your site to show visitors the result.

## Get the badge

The badge is served at:

```text
https://vigilbase.com/api/badge/{domain}
```

After a successful Website Security scan, the result shows a preview and the HTML to copy:

```html
<a href="https://vigilbase.com/tools/website-security" target="_blank" rel="noopener noreferrer"><img src="https://vigilbase.com/api/badge/example.com" alt="example.com - Security Grade - Scanned by Vigilbase" title="Security scan powered by Vigilbase"></a>
```

From the CLI, `vigilbase badge example.com` prints the badge URL without making a request.

## Styles

Add `?style=` to choose a style:

| Style | URL | Shape |
| --- | --- | --- |
| `default` | `/api/badge/example.com` | 56 px high, with "SECURITY VERIFIED", the domain and the grade |
| `compact` | `/api/badge/example.com?style=compact` | 44 px high, the same content smaller |
| `mini` | `/api/badge/example.com?style=mini` | 28 px high, the domain and the grade only |

Long domains are shortened with `..` to fit.

## Which grade it shows

The badge shows the grade of the most recent completed Website Security scan of that exact domain whose result Vigilbase can verify. A leading `www.` and a trailing dot are ignored, so `www.example.com` and `example.com` show the same badge.

It shows `?` in grey when there is no such scan, for example when the domain was never scanned with Website Security. Results from other tools, and self-reported Cloudflare Checkup results, never appear on a badge.

| Grade | Colour |
| --- | --- |
| A+, A | Green |
| B | Blue |
| C | Yellow |
| D | Orange |
| F | Red |

## Caching and limits

Badges with a grade are cached for a day; a `?` badge is cached for an hour, so a new scan can take that long to appear. Each client IP can request 60 badges a minute; beyond that the badge URL answers `429` with `Retry-After`. An invalid domain answers `400`.