{"uid":"cap_C5b2GTFBua_QFSFcLq4iy","slug":"lookproof-http-security-headers-checker-6d39f5bb","name":"Lookproof HTTP Security Headers Checker","description":"Check SPF, DMARC, DKIM, MTA-STS, DNSSEC and more, with results that explain what was found and why. Free browser checks and a pay-per-request API with x402.","url":"https://api.lookproof.dev/v1/http/security-headers?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET","HEAD","DELETE"],"type":"string"},"queryParams":{"type":"object","title":"DomainInput","required":["domain"],"properties":{"domain":{"type":"string","title":"Domain","examples":["example.com"],"maxLength":1024,"minLength":1}},"additionalProperties":false}},"additionalProperties":false}}},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_pCnrA-gvLTeZcLZoYJ38K","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Follows a domain's HTTP-to-HTTPS redirect chain and inspects the security headers of the final HTTPS response, including HSTS, CSP, X-Content-Type-Options, framing, Referrer-Policy, and cookie flags.","exampleAgentPrompt":"Can you check the HTTP security headers for example.com — specifically whether it enforces HTTPS, if it's HSTS preload ready, and whether any key headers like CSP or X-Content-Type-Options are missing?","exampleUseCases":[{"title":"Pre-launch security header audit","prompt":"We're about to launch shop.mybrand.com — can you check its HTTP security headers and tell me if it properly redirects to HTTPS, whether it has HSTS set up correctly for preload, and flag any missing headers like CSP or X-Content-Type-Options?"},{"title":"Diagnosing HSTS preload rejection","prompt":"Our domain secure.example.org keeps getting rejected from the HSTS preload list — can you inspect its security headers and tell me exactly why it's failing HSTS preload requirements?"},{"title":"Checking CSP for unsafe-inline","prompt":"Can you look at the security headers on payments.acmecorp.com and tell me if its Content-Security-Policy contains unsafe-inline, and whether the cookies look properly secured?"}],"resultDescription":"Returns the full redirect chain from HTTP and HTTPS origins to the final HTTPS destination, along with parsed security header findings: HSTS presence, max-age, includeSubDomains, preload flag and preload readiness assessment; CSP presence and unsafe-inline detection; X-Content-Type-Options value; frame protection (X-Frame-Options or CSP frame-ancestors); Referrer-Policy value; and cookie security flags (Secure, HttpOnly, SameSite — flags only, not values). Missing headers are explicitly flagged.","failureModes":["Domain does not resolve — DNS lookup failure returned","Site does not respond to HTTP or HTTPS — connection timeout","Domain redirects to a non-HTTPS final URL — HTTPS enforcement failure noted","Invalid domain format supplied — input validation error","Rate limiting or upstream block prevents header fetch — error response returned","Final destination returns non-standard or missing headers — gaps explicitly noted in output"],"whenToPreferThis":"Choose this endpoint when you need to audit a specific domain's HTTPS enforcement and HTTP security header posture — particularly when you need HSTS preload readiness analysis, CSP unsafe-inline detection, or a complete view of which security headers are present or absent. It is distinct from TLS certificate checkers (which inspect the cert itself), DNS security auditors, and general HTTP response inspectors. Use it for pre-launch security reviews, HSTS preload submission troubleshooting, compliance checks, or ongoing security monitoring of web properties.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-31T18:40:03.665Z","isFirstParty":false,"canonicalSlug":"lookproof-http-security-headers-checker-6d39f5bb"}