# Embed the Index on your site

DefenceLevel Index

The DEFCON level of the DefenceLevel Index on your site or in your tools: free of charge, with attribution.

Last updated: 25 October 2026

## The badge

An image with the current level that updates itself. Paste this code wherever you want to show it: it works on any page, WordPress included, with no scripts.

![DefenceLevel Index: current DEFCON level](https://defencelevel.com/api/badge.svg?lang=en)![DefenceLevel Index: current DEFCON level](https://defencelevel.com/api/badge.svg?lang=en&theme=light)

```
<a href="https://defencelevel.com/index"><img src="https://defencelevel.com/api/badge.svg?lang=en" width="232" height="64" alt="DefenceLevel Index: current DEFCON level"></a>
```

For a light background add `&theme=light` to the image address. Choose the language with `lang`: `en`, `de`, `es`, `fr` or `it`.

## The data

For developers: these addresses on https://defencelevel.com can be read from any website, with no access key.

| Address | Content |
| --- | --- |
| `/api/status?lang=en` | Current level: DEFCON, level name and message in the chosen language, time of the last update in UTC. |
| `/api/trend?days=30` | Level of each day over the last 30 days (or 90 or 365), with the number of selected vulnerabilities and the Index summary figures. |
| `/api/trend?days=365&format=csv` | The same data as a CSV file. |
| `/index/feed.xml` | Atom feed with the level of each day. |
| `/cve/feed.xml` | Atom feed of the pages of the vulnerabilities that appeared in the briefings: CVE ID, title and most severe level, 7 days after the first appearance, at once for those at DEFCON 1–2. |

The full description, in OpenAPI format, is at [/openapi.json](https://defencelevel.com/openapi.json).

Example response for the current level:

```
{
  "defcon": 3,
  "label": "Substantial risk",
  "message": "If you use the products under attack, update them now.",
  "color": "#EA580C",
  "updated_at": "2026-10-06T05:00:00.000Z",
  "exploited": 8,
  "urgent_today": 0,
  "stats": {
    "observations": 503,
    "evaluated": 305,
    "selected": 9,
    "noise": 0
  }
}
```

## Examples

The current level from the command line, with curl:

```
curl -s "https://defencelevel.com/api/status?lang=en"
```

In Python, with no external libraries:

```
import json
import urllib.request

with urllib.request.urlopen("https://defencelevel.com/api/status?lang=en", timeout=10) as r:
    data = json.load(r)

print(f"DEFCON {data['defcon']}: {data['label']}")
```

The levels of the last 30 days as a CSV file:

```
curl -s "https://defencelevel.com/api/trend?days=30&format=csv"
```

## Updates

- The current level is recalculated at every collection, about every 30 minutes.
- The level of the day is set at 05:00 UTC and then never changes.
- Responses are cached for a few minutes: reading them at most once every 5 minutes is enough.

## Licence and attribution

Index data is published under the [Creative Commons Attribution 4.0](https://creativecommons.org/licenses/by/4.0/) licence (CC BY 4.0): you can use it freely, including for commercial purposes, citing the source with a link to defencelevel.com.

```
Source: DefenceLevel Index (defencelevel.com)
```

The badge already carries the attribution: just keep the link to the Index. Full conditions are in the [Terms of service](https://defencelevel.com/terms#use).

## What is not included

The briefing texts, that is why a vulnerability matters, who is affected and what to do, remain for subscribers. For vulnerabilities, only the CVE ID, title, level and days in the briefings are public, on the /cve pages.

## Contact

For a different kind of integration, write to [info@defencelevel.com](mailto:info@defencelevel.com).

---

Web page: https://defencelevel.com/index/api