{"uid":"cap_BMMY7o_DPH1tjLR9cUD9U","slug":"domainaudit-http-security-headers-grader-8cfde7cf","name":"DomainAudit HTTP Security Headers Grader","description":"Grade a web page A-F on HTTP security headers (HSTS, CSP, framing, nosniff, Referrer-Policy, Permissions-Policy, cookie flags, version leakage, http->https redirect) with the value and a concrete fix per check.","url":"https://domainaudit.genexxis.com/headers?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["url"],"properties":{"url":{"type":"string","description":"Page URL (https://...) or plain hostname"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"url":"https://example.com/","grade":"F","score":15,"checks":[{"id":"hsts","fix":"Add Strict-Transport-Security: max-age=31536000; includeSubDomains","pass":false,"value":null},{"id":"x_content_type_options","fix":null,"pass":true,"value":"nosniff"}],"status":200}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.005","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.005/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.005","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_Y5VNZXP2_D82IsRugekD-","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.005","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Grades a web page A-F on HTTP security headers, returning per-check pass/fail results with current header values and concrete remediation advice.","exampleAgentPrompt":"Can you audit the HTTP security headers on https://acmecorp.com and give me an A-F grade with a fix for each failing check like HSTS, CSP, nosniff, and cookie flags?","exampleUseCases":[{"title":"Pre-launch security header review","prompt":"We're about to launch our new site at https://launch.myapp.io — can you audit all its HTTP security headers and tell me what grade it gets, which checks fail, and exactly what headers to add to fix each issue?"},{"title":"Client website security report","prompt":"I need a security header audit for my client's site https://www.clientbrand.com — grade it A-F and list every check like HSTS, CSP, X-Content-Type-Options, framing, and Referrer-Policy with the current value and a concrete fix for anything that fails."},{"title":"Catching server version leakage","prompt":"Check https://api.oldstack.net for HTTP security header issues, especially whether it's leaking server version info, and tell me what score it gets and how to fix the problems."}],"resultDescription":"A JSON object containing the URL, an A-F letter grade, a numeric score, the HTTP status code of the page, and an array of individual checks — each with a check ID (e.g. 'hsts', 'csp', 'x_content_type_options'), a pass/fail boolean, the current header value (or null if absent), and a concrete fix string for failing checks.","failureModes":["Invalid or unreachable URL returns an error — ensure the target is publicly accessible","Non-HTTPS URLs may return limited results since some checks require TLS","DNS resolution failure for the provided hostname results in an error response","Timeout if the target server is slow to respond","Paywalled or bot-blocked sites may return unexpected HTTP status codes affecting check accuracy"],"whenToPreferThis":"Choose this endpoint when you need a structured, per-header breakdown with letter grades and actionable fix strings for HTTP security headers specifically. It is more focused than a full-stack domain audit endpoint and cheaper per call; prefer it when you only need header analysis without TLS certificate details, DNS records, or RDAP data. Ideal for CI/CD pipelines, pre-launch checklists, or security review workflows targeting a single URL.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-11-04T12:32:44.251Z","isFirstParty":false,"canonicalSlug":"domainaudit-http-security-headers-grader-8cfde7cf"}