Web of Trust Getting Started: API Integration Guide (2026)

Getting started overview

Integrating Web of Trust (WOT) into your applications allows you to programmatically access website reputation data, aiding in the identification of potentially malicious or untrustworthy URLs. The Getting Started process focuses on obtaining the necessary credentials and executing your initial API request to retrieve reputation scores and categories for a given domain or URL. This foundational step enables developers to build features for phishing prevention and malware site detection.

The WOT API typically provides a JSON response containing a trustworthiness score, a child safety score, and contextual information, based on community ratings and proprietary algorithms. Understanding these scores is critical for interpreting the API's output correctly. A lower score generally indicates a higher risk. For instance, a trustworthiness score below 60 might suggest caution, while a score below 30 could indicate a high-risk site. Specific thresholds for 'good' or 'bad' reputation are often defined by your application's security policies.

Before making any requests, ensure you have a clear understanding of the WOT API pricing structure and any usage limits associated with your plan. Accessing the WOT API requires a specific API key, which authenticates your requests and links them to your account.

Here's a quick reference table outlining the key steps:

Create an account and get keys

To begin using the Web of Trust API, you must first create an account on the official WOT website. While a basic browser extension is available as a free tier, API access typically requires engagement with their sales team to discuss specific use cases and obtain a suitable plan. Follow these steps:

1. Visit the WOT Homepage: Navigate to the official Web of Trust website.
2. Sign Up/Log In: Look for a 'Sign Up' or 'Register' option. If you already have an account, log in. Account creation usually involves providing an email address and setting a password.
3. Request API Access: Once logged in, navigate to the developer or API section of your account dashboard. The specific path may vary, but you will typically find an option to 'Request API Access' or 'Contact Sales for API'. The WOT API is not part of the standard free tier and requires a commercial agreement for use in applications beyond the personal browser extension.
4. Obtain API Key: After your API access request is approved and your plan is established, your unique API key will be generated and made available in your developer dashboard. This key is a string of alphanumeric characters that authenticates your requests. Treat your API key as sensitive information; do not hardcode it directly into client-side code or expose it publicly.

Understanding WOT's pricing models is essential, as API calls are typically metered. Ensure your chosen plan aligns with your expected usage volume to avoid unexpected charges or service interruptions.

Your first request

With an active account and your API key, you can now make your first request to the WOT API. The core functionality involves querying a specific URL or domain to retrieve its reputation data. The WOT API provides a RESTful interface, meaning you interact with it using standard HTTP methods, predominantly GET. Responses are typically formatted in JSON.

A common endpoint for reputation lookup is structured similarly to this (replace placeholders):

GET https://api.mywot.com/v2/public/score?hosts={target_host}&key={your_api_key}

Let's use an example to demonstrate a request using curl, a common command-line tool for making HTTP requests. For this example, we'll query the reputation of example.com. Replace YOUR_API_KEY with your actual API key.

curl "https://api.mywot.com/v2/public/score?hosts=example.com&key=YOUR_API_KEY"

Upon a successful request, the WOT API will return a JSON object similar to the following (actual values will vary):

{
  "example.com": {
    "0": [
      60,
      30,
      0,
      0
    ],
    "target": "example.com",
    "last_update": 1678886400,
    "categories": {
      "101": 60,
      "503": 30
    },
    "safety": {
      "trust": 60,
      "privacy": 30,
      "stability": 0,
      "childsafety": 0
    }
  }
}

Deciphering the Response:

• "0": [60, 30, 0, 0]: This array typically represents [trustworthiness, privacy, reliability, childsafety] scores. Each score ranges from 0 (very poor) to 100 (excellent).
• "target": "example.com": The host that was queried.
• "last_update": 1678886400: A Unix timestamp indicating when the reputation data was last updated.
• "categories": An object detailing specific categories and their associated scores. For example, "101": 60 might relate to a general trustworthiness category, and "503": 30 to a specific risk category. WOT maintains a list of category IDs and their meanings.
• "safety": An object providing named scores for trust, privacy, reliability, and child safety.

For a detailed breakdown of all possible response fields and their interpretations, consult the official WOT API documentation.

Common next steps

After successfully making your first API call and understanding the response format, consider these common next steps to integrate WOT reputation data effectively into your application:

1. Error Handling: Implement robust error handling for various API response codes (e.g., 400 for bad request, 401 for unauthorized, 403 for forbidden, 404 for not found, 429 for too many requests, 500 for internal server error). This ensures your application can gracefully manage issues such as invalid API keys or rate limits.
2. Rate Limiting Management: The WOT API, like many public APIs, enforces rate limits to prevent abuse and ensure service stability. Monitor HTTP headers for rate limit information (e.g., X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset) and design your application to respect these limits, potentially using exponential backoff or a queueing mechanism for requests.
3. Data Caching: To reduce API calls and improve performance, implement a caching strategy for reputation data. Since reputation scores for a given URL do not change instantaneously, caching results for a reasonable period (e.g., hours or days, depending on your use case) can significantly reduce your API consumption.
4. Contextual Interpretation: Develop logic within your application to interpret the WOT scores in a meaningful way for your users. For instance, you might display color-coded indicators (green for safe, yellow for caution, red for dangerous) based on the trustworthiness score thresholds you define.
5. Logging and Monitoring: Log API requests and responses, especially for troubleshooting and auditing purposes. Monitor API usage and performance to identify potential issues or opportunities for optimization.
6. Integrate into Workflow: Determine where in your application's workflow reputation checks are most effective. This could be during user input validation, link analysis in emails, or real-time URL scanning for content moderation.
7. Explore Additional Endpoints: Review the comprehensive WOT API documentation for other available endpoints or features that might enhance your integration, such as bulk lookup or historical data if offered.

Troubleshooting the first call

Encountering issues during your first API call is common. Here are some troubleshooting steps and common problems along with their solutions:

1. Invalid API Key (HTTP 401 Unauthorized or 403 Forbidden):
   • Problem: Your API key might be incorrect, expired, or not properly authorized for the endpoint you're trying to access.
   • Solution: Double-check that you've copied your API key exactly as provided in your WOT developer dashboard. Ensure there are no extra spaces or characters. Verify that your API plan supports the specific endpoint you are calling. Generate a new key if previous attempts fail.
2. Incorrect Endpoint or Parameters (HTTP 400 Bad Request):
   • Problem: The URL for the API endpoint is wrong, or the parameters (like hosts) are malformed or missing.
   • Solution: Compare your request URL meticulously with the WOT API documentation. Ensure all required parameters are present and correctly formatted (e.g., URL-encoded if necessary for special characters in the host).
3. Network Issues (Connection Timeout, DNS Resolution Failure):
   • Problem: Your server or local machine cannot reach the WOT API servers due to network connectivity issues, firewall restrictions, or incorrect DNS settings.
   • Solution: Check your internet connection. If you're on a corporate network, ensure that firewalls or proxy servers are not blocking outgoing requests to api.mywot.com. Try pinging the API host to confirm basic network reachability.
4. Rate Limit Exceeded (HTTP 429 Too Many Requests):
   • Problem: You've made too many requests in a short period, exceeding your plan's rate limits.
   • Solution: Wait for the rate limit window to reset (check Retry-After HTTP header if provided). Design your application with rate limiting in mind, implementing delays or a queue for requests.
5. Empty or Unexpected Response:
   • Problem: The API returns an empty response body, a non-JSON response, or a JSON structure that doesn't match the documentation.
   • Solution: Verify the Accept header in your request (though usually defaulting to JSON). If the response is empty, the queried host might not have reputation data available, or there could be an issue with the host parameter. Ensure the target host in your request is a valid domain or URL.
6. SSL/TLS Handshake Errors:
   • Problem: Your client fails to establish a secure connection with the WOT API servers, often due to outdated SSL certificates on your client's OS or an incorrect trust store.
   • Solution: Ensure your operating system and HTTP client libraries are up to date and have current root certificates. If using curl, ensure it's compiled with a modern SSL library.

Always consult the official WOT API documentation for the most up-to-date information on endpoints, parameters, and error codes.