{"uid":"cap_-M457c1H793cNhXACtHcQ","slug":"tinstop-http-security-headers-check-3e2f40ed","name":"Tinstop HTTP Security Headers Check","description":"Tinstop is a machine-payable Website Intelligence API for domain security and performance audits: DNS, SSL/TLS, HTTP security headers, SPF/DKIM/DMARC email authentication, and Google PageSpeed. Pay per call with x402 using USDC on Base. No accounts or API keys.","url":"https://tinstop.com/v1/headers-check","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"domain":{"type":"string","description":"The domain name to check (e.g. 'example.com'). Do not include http:// or https:// protocol prefixes."}}},"responseSchema":{"type":"object","title":"HeadersCheckResponse","required":["domain","http_status","headers","missing_headers","grade","recommendations","issues","scan_id"],"properties":{"grade":{"type":"string","title":"Grade","description":"Security score grade (A/B/C/D/F) based on recommended headers"},"cached":{"type":"boolean","title":"Cached","default":false},"domain":{"type":"string","title":"Domain"},"issues":{"type":"array","items":{"type":"object","additionalProperties":true},"title":"Issues"},"headers":{"type":"object","title":"Headers","additionalProperties":{"anyOf":[{"type":"string"},{"type":"null"}]}},"scan_id":{"type":"string","title":"Scan Id"},"request_id":{"anyOf":[{"type":"string"},{"type":"null"}],"title":"Request Id","description":"Gateway request tracking ID"},"http_status":{"type":"integer","title":"Http Status"},"missing_headers":{"type":"array","items":{"type":"string"},"title":"Missing Headers"},"recommendations":{"type":"array","items":{"type":"string"},"title":"Recommendations","description":"Detailed configuration improvements for missing headers"}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.02","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"registry","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.02/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_y4Mkf9jayS4j868RHjX8a","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.02","costPer":"request","priority":0,"asset":null,"unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Audits a domain's HTTP security headers, grades them A–F, and returns missing headers with remediation recommendations.","exampleAgentPrompt":"Can you audit the HTTP security headers for stripe.com and tell me what grade it gets, which headers are missing, and what I should fix?","exampleUseCases":[{"title":"Pre-launch security header audit","prompt":"Before we go live, can you check the HTTP security headers on staging.myapp.com and tell me what grade we get and which headers we still need to add?"},{"title":"Competitor security posture comparison","prompt":"I want to know how good our competitor's web security headers are — can you audit shopify.com's HTTP headers and give me the grade and a list of any missing headers?"},{"title":"Ongoing compliance monitoring","prompt":"Can you check github.com's HTTP security headers and flag any missing ones or issues I should be aware of for our compliance review?"}],"resultDescription":"Returns a JSON object containing the domain, HTTP status code, a full map of present response headers, an array of missing recommended security headers, an A–F security grade, a list of specific issues found, detailed recommendations for fixing each missing header, a unique scan ID, and a flag indicating whether the result was cached.","failureModes":["Domain unreachable or does not exist — may return error or low-grade result with empty headers","Domain provided with http:// or https:// prefix — schema requires bare domain without protocol","Rate limiting or upstream connectivity issues may delay or fail the scan","Domain resolves but returns unexpected HTTP status codes causing incomplete header analysis"],"whenToPreferThis":"Choose this endpoint when you need a focused, structured audit of HTTP security response headers specifically — including Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, and similar — with an actionable letter grade and remediation advice. It is the right choice over generic DNS or SSL checks when the goal is hardening web application HTTP response security. It is distinct from the email authentication (SPF/DKIM/DMARC) and DNS sibling endpoints on the same platform.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T06:31:13.055Z","isFirstParty":false}