{"uid":"cap_1iYi6lbcinVICw9zYOsx7","slug":"lookproof-hsts-header-parser-ac32a3de","name":"Lookproof HSTS Header Parser","description":"Check SPF, DMARC, DKIM, MTA-STS, DNSSEC and more, with results that explain what was found and why. Free browser checks and a pay-per-request API with x402.","url":"https://api.lookproof.dev/v1/http/hsts-parse?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"header":{"type":"string","title":"Header","maxLength":8192,"minLength":1}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_CUUzcHchEfV79OCrGGt2d","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Parses a Strict-Transport-Security (HSTS) header value per RFC 6797, returning max-age, includeSubDomains, preload flags, and hstspreload.org rule compliance — offline, no DNS required.","exampleAgentPrompt":"Can you parse this HSTS header and tell me if it meets hstspreload.org requirements: 'max-age=31536000; includeSubDomains; preload'?","exampleUseCases":[{"title":"Validate HSTS before preload submission","prompt":"I'm about to submit my site to the HSTS preload list — can you check whether this header value is valid and meets all the hstspreload.org rules: 'max-age=63072000; includeSubDomains; preload'?"},{"title":"Debug HSTS misconfiguration","prompt":"My HSTS header is 'max-age=86400; includeSubDomains' — can you parse it and tell me whether browsers will accept it and if there are any issues, like the max-age being too short for preloading?"},{"title":"Confirm HSTS setup after deployment","prompt":"We just deployed HSTS on our site. Parse this header and confirm all the fields are correct: 'max-age=31536000; includeSubDomains; preload' — I need to know the max-age, whether subdomains are covered, and if the preload flag is properly set."}],"resultDescription":"Returns a structured breakdown of the parsed HSTS header: whether browsers would accept it, the max-age value in seconds, presence of includeSubDomains and preload directives, and which hstspreload.org header rules the header satisfies or fails. Computed offline without any DNS or network lookups.","failureModes":["Empty or missing header field returns a validation error","Header value exceeding 8192 characters is rejected","Malformed or non-HSTS header string may return parsing errors or incomplete results","No network access to verify live server — only the supplied string is parsed"],"whenToPreferThis":"Use this endpoint when you need to validate or debug an HSTS header string offline — especially when setting up HSTS for the first time, preparing a site for hstspreload.org submission, or checking whether a header string meets RFC 6797 requirements without needing DNS or a live server response.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-31T18:41:13.549Z","isFirstParty":false,"canonicalSlug":"lookproof-hsts-header-parser-ac32a3de"}