{"uid":"cap_-OMcbL6dQeUohKSEzcBsV","slug":"sitecheck-web-intel-security-headers-checker-d4e7d20f","name":"SiteCheck Web Intel – Security Headers Checker","description":"Checks the live HTTP response headers of a site's home page (one GET, https) for Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy. Returns present/missing headers with their values and a score out of 7. It does not judge the quality of the values.","url":"https://api.webintel-api.workers.dev/api/security/security-headers?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["domain"],"properties":{"domain":{"type":"string","description":"Domain name such as wikipedia.org (required)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"score":1,"domain":"wikipedia.org","source":"https://wikipedia.org/","missing":["content-security-policy","x-content-type-options"],"present":{"strict-transport-security":"max-age=106384710; includeSubDomains; preload"},"finalUrl":"https://www.wikipedia.org/","maxScore":7,"checkedAt":"2026-10-23T09:38:33.527Z","httpStatus":200}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_jeVHVrRY3tQiO3yDNDz4a","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Fetches a domain's HTTP response headers and scores them against security best practices, reporting which headers are present or missing.","exampleAgentPrompt":"Can you check the security headers for wikipedia.org and tell me which ones are missing and what score it gets?","exampleUseCases":[{"title":"Pre-launch security header audit","prompt":"Before we go live, can you check the security headers on staging.myapp.io and tell me which ones are missing so we can fix them?"},{"title":"Competitor security posture check","prompt":"How does shopify.com score on HTTP security headers? I want to know what they have configured and what's missing."},{"title":"Compliance verification for client site","prompt":"Can you run a security headers check on clientdomain.com and give me a score and list of any missing headers I should include in my report?"}],"resultDescription":"Returns a JSON object with a numeric security score and max possible score, the domain checked, the final resolved URL, HTTP status, a list of present headers with their values, a list of missing recommended security headers, and the timestamp of the check.","failureModes":["Domain does not exist or is unreachable — request may fail or return error","Domain redirects indefinitely — final URL may differ significantly","Server returns non-standard headers that don't map to expected security header names","Rate limiting or network timeouts from the target domain","Invalid domain format provided as input"],"whenToPreferThis":"Use this endpoint when you need a quick, pay-per-call audit of a domain's HTTP security headers without setting up any account or API key. It is ideal for one-off checks, automated security scanning pipelines, or compliance reporting where you need a scored breakdown of present vs. missing headers like CSP, HSTS, and X-Content-Type-Options.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-25T12:31:12.944Z","isFirstParty":false,"canonicalSlug":"sitecheck-web-intel-security-headers-checker-d4e7d20f"}