Is PhishGuard's API free to use?

Yes. The basic tier is completely free with no API key required. Rate limits apply to prevent abuse. A higher-rate authenticated tier is available for registered users.

What does the PhishGuard API return?

The API returns a JSON response with a risk score (0-100), risk level (LOW/MEDIUM/HIGH/CRITICAL), threat categories, SSL status, domain age, brand impersonation detection, and individual check results.

Can I use PhishGuard API in a browser extension?

Yes. PhishGuard's API is designed for integration into browser extensions, mobile apps, and web applications. CORS is enabled for registered API users.

How do I integrate PhishGuard's phishing detection API into my Python application?

Install requests library, then POST to https://www.phishguard.co.in/api/analyze-url with JSON body {"url": "https://example.com"}. Include your API key in the Authorization header as 'Bearer YOUR_API_KEY'. The response includes risk_score (0-100), risk_level (SAFE/SUSPICIOUS/HIGH/CRITICAL), ssl_valid, domain_age_days, is_phishing, and detailed check_results array. Basic tier is free with 500 requests/day. Full API documentation is available on this page.

What is the rate limit for PhishGuard's free phishing detection API?

Free tier: 500 requests per day, 30 requests per minute, max 100 URLs per batch scan. No API key required for basic single URL checks (lower rate limit applies). Register for a free account to get an API key and access the full 500/day allowance. The API returns standard HTTP 429 with Retry-After header when rate limited. For higher volume needs, contact the PhishGuard team via the developer portal.

Can I use PhishGuard API to build a browser extension for phishing protection in India?

Yes — PhishGuard API is built for exactly this use case. The /api/analyze-url endpoint returns results in under 3 seconds, suitable for real-time browser extension lookups. Use the risk_score field to decide whether to warn the user. Implement caching for recently scanned URLs to reduce API calls. We recommend checking URLs on navigation events rather than on every link hover to stay within rate limits. See the API documentation section for a complete browser extension starter template.

Does PhishGuard offer a batch URL scanning API for bulk phishing checks?

Yes — the /api/analyze-batch endpoint accepts up to 100 URLs per request in a JSON array. It returns individual results for each URL. Batch scanning is ideal for: email security gateways scanning links in incoming emails, security teams processing threat intelligence feeds, automated content moderation for user-submitted URLs. Batch endpoint has a separate rate limit of 10 requests per minute with a maximum of 100 URLs per request.

What data does PhishGuard's API return for each scanned URL?

The API response includes: url (normalised), risk_score (0-100 integer), risk_level (SAFE / SUSPICIOUS / HIGH / CRITICAL), is_phishing (boolean), domain (extracted domain), domain_age_days (integer, -1 if unknown), ssl_valid (boolean), ssl_issuer (string), ip_address, ip_country, is_newly_registered (boolean, true if < 30 days old), brand_impersonation_detected (boolean), brand_targeted (string or null), check_results (array of individual check names and pass/fail), scan_id (shareable report URL), and scan_timestamp (ISO 8601).

How does PhishGuard API handle URLs with authentication tokens or session parameters?

PhishGuard analyses the structural and domain components of URLs, not authenticated content behind login walls. Query parameters are analysed for suspicious patterns (excessive length, base64 encoding, redirect parameters) but are not used to access authenticated resources. This makes the API safe to use on URLs that include session tokens — PhishGuard will not attempt to access the authenticated session. Sensitive query parameter values are not logged in scan reports.

Can I use PhishGuard API to protect a UPI payment gateway or fintech application?

Yes — this is one of PhishGuard's primary developer use cases. Integrate the API as a pre-flight check on any URLs submitted by users (e.g., merchant payment pages, investment platform links). The /api/analyze-url endpoint can be called synchronously in your payment flow with a <3 second SLA. Block or flag transactions involving HIGH or CRITICAL risk URLs. Use the is_phishing and brand_impersonation_detected fields as direct inputs to your risk scoring model.

What programming languages and frameworks does PhishGuard API support?

PhishGuard API is a standard REST API with JSON request/response — compatible with any language or framework. We provide code examples for Python (requests), JavaScript/Node.js (fetch, axios), PHP (cURL), Java (HttpClient), and Go (net/http) in the documentation. For Python, a thin wrapper is available. The API supports CORS for browser-based applications and standard Bearer token authentication. No SDK installation required — a single HTTP POST is all you need.

How do I get a PhishGuard API key and what are the terms of use for developers?

Register at phishguard.co.in/signup with a valid email. After email verification, go to Dashboard → API Key to generate your key. Free tier allows personal projects, open source tools, academic research, and non-commercial applications. Commercial use requires attribution linking back to PhishGuard. Security tools and browser extensions protecting Indian users are encouraged. Prohibited uses: submitting URLs for data harvesting, reverse engineering the detection model, or using the API for purposes that harm end users.

Does PhishGuard API return results in regional Indian languages?

Currently PhishGuard API returns all responses in English. The risk_level values (SAFE, SUSPICIOUS, HIGH, CRITICAL) are designed to be translated by the consuming application into any regional language. PhishGuard is actively working on Hindi localisation for the API response messages and web interface. The awareness content and blog are available in English only currently. If you are building a vernacular language safety app for Indian users, contact the PhishGuard team for early access to localised response messages.

Free Phishing Detection API India — REST API for Developers

Plans

Plan	Price	Daily Limit	Webhooks	Support
Free	₹0	500 req/day	Up to 3	Community
Pro	Coming soon	50,000 req/day	Up to 20	Email
Enterprise	Contact us	Unlimited	Unlimited	Priority

Get Your Free API Key

Register below to get your key instantly. No credit card required.

Your API Key (save this — shown only once):

Pass as X-API-Key header or ?api_key= query param.

Quick Start

Analyze a URL (replace YOUR_KEY):

curl -X POST https://phishguard.in/api/analyze-url \ -H "X-API-Key: YOUR_KEY" \ -H "Content-Type: application/json" \ -d '{"url": "https://example-suspicious.tk/verify"}'

Python example:

import requests API_KEY = "YOUR_KEY" URL_TO_SCAN = "https://example-suspicious.tk/verify" response = requests.post( "https://phishguard.in/api/analyze-url", headers={"X-API-Key": API_KEY, "Content-Type": "application/json"}, json={"url": URL_TO_SCAN} ) result = response.json() print(f"Risk Level: {result['risk_level']}") print(f"Risk Score: {result['risk_score']}/100")

API Endpoints

POST/api/analyze-url

Analyze a URL for phishing. Returns risk level, score, and detailed breakdown.

{"url": "https://example.com"}

POST/api/check-ssl

Check SSL certificate validity and details for a domain.

{"domain": "example.com"}

POST/api/dns-lookup

Get DNS records (A, AAAA, MX, NS, TXT, CNAME), SPF and DMARC presence.

{"domain": "example.com"}

POST/api/expand-link

Trace redirect chain of a shortened/redirect URL.

{"url": "https://bit.ly/xyz"}

POST/api/ip-reputation

Get geolocation and proxy/hosting reputation for an IP or domain.

{"ip": "1.2.3.4"}

POST/api/website-age

Check domain registration age via WHOIS.

{"domain": "example.com"}

GET/api/developer/usage

Check your API key usage stats.

POST/api/webhooks

Register a webhook to receive alerts when HIGH or SUSPICIOUS URLs are detected.

{"url": "https://your-server.com/webhook"}

DELETE/api/webhooks/{id}

Remove a webhook.

Webhooks

Register a webhook to get notified whenever PhishGuard detects a HIGH or SUSPICIOUS URL. We'll POST to your URL with a signed payload.

Verify webhook authenticity using the X-PhishGuard-Signature header:

import hmac, hashlib def verify_webhook(payload_body: bytes, signature_header: str, secret: str) -> bool: expected = "sha256=" + hmac.new( secret.encode(), payload_body, hashlib.sha256 ).hexdigest() return hmac.compare_digest(expected, signature_header)

Example webhook payload:

{
  "event": "url_scanned",
  "risk_level": "HIGH",
  "risk_score": 87,
  "url": "https://paypal-secure-verify.tk/login",
  "domain": "paypal-secure-verify.tk",
  "category": "Brand Impersonation",
  "timestamp": "2026-02-21T12:34:56Z"
}

Rate Limits

Endpoint	Limit
`/api/analyze-url`	30 req/min
`/api/check-ssl`	20 req/min
`/api/dns-lookup`	20 req/min
`/api/expand-link`	30 req/min
`/api/ip-reputation`	20 req/min
`/api/website-age`	20 req/min
All endpoints	200 req/hour global

HTTP 429 is returned when limits are exceeded. Retry after the indicated time.