{"uid":"cap_ECYfddJFQgWo0sxyh5Tdx","slug":"netintel-security-headers-analyzer-1532af36","name":"NetIntel Security Headers Analyzer","description":"Fetches a URL and evaluates 10 security-critical response headers (CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, CORP, COEP, COOP), detects anti-patterns, and returns an overall security grade (A–F).","url":"https://netintel.dev/security-headers/analyze?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["target"],"properties":{"target":{"type":"string","description":"URL or domain to audit security headers for (e.g. https://example.com)"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","properties":{"meta":{"type":"object"},"grade":{"type":"string"},"score":{"type":"number"},"errors":{"type":"array"},"target":{"type":"string"},"results":{"type":"object"},"service":{"type":"string"},"warnings":{"type":"array"},"timestamp":{"type":"string"},"deductions":{"type":"array"}}}}}}},"responseSchema":{"type":"json","example":{"meta":{"duration_ms":312},"grade":"B","score":78,"errors":[],"target":"https://example.com","results":{"headers":{"referrer-policy":{"reason":"Referrer-Policy is set to strict-origin-when-cross-origin","status":"pass","present":true,"raw_value":"strict-origin-when-cross-origin"},"x-frame-options":{"reason":"X-Frame-Options is set to DENY","status":"pass","present":true,"raw_value":"DENY"},"x-xss-protection":{"reason":"X-XSS-Protection not set — modern browsers use CSP instead","status":"info","present":false,"raw_value":null},"permissions-policy":{"reason":"Permissions-Policy not set — browser features not restricted","status":"warn","present":false,"raw_value":null},"x-content-type-options":{"reason":"X-Content-Type-Options is set to nosniff","status":"pass","present":true,"raw_value":"nosniff"},"content-security-policy":{"reason":"Content-Security-Policy is set with a strong policy","status":"pass","present":true,"raw_value":"default-src 'self'"},"strict-transport-security":{"reason":"HSTS enabled with max-age=31536000","status":"pass","present":true,"raw_value":"max-age=31536000; includeSubDomains"},"cross-origin-opener-policy":{"reason":"Cross-Origin-Opener-Policy not set","status":"info","present":false,"raw_value":null},"cross-origin-embedder-policy":{"reason":"Cross-Origin-Embedder-Policy not set","status":"info","present":false,"raw_value":null},"cross-origin-resource-policy":{"reason":"Cross-Origin-Resource-Policy not set","status":"info","present":false,"raw_value":null}},"summary":{"fail":0,"info":4,"pass":6,"warn":0},"final_url":"https://example.com/","status_code":200,"content_type":"text/html; charset=utf-8","anti_patterns":[{"header":"x-powered-by","reason":"Information leakage — reveals server framework","severity":"warn","raw_value":"Express"}]},"service":"security-headers","warnings":[],"timestamp":"2025-01-15T12:00:00.000Z","deductions":[{"points":-5,"reason":"Permissions-Policy not set"},{"points":-2,"reason":"Cross-Origin-Resource-Policy not set"},{"points":-2,"reason":"Cross-Origin-Embedder-Policy not set"},{"points":-2,"reason":"Cross-Origin-Opener-Policy not set"},{"points":-3,"reason":"X-Powered-By header exposes server framework"}]}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_ekK-drO19ZSCAkjTI7Pvh","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Audits HTTP security headers for a given URL or domain, returning a letter grade, numeric score, per-header pass/warn/fail results, and anti-pattern detections.","exampleAgentPrompt":"Can you audit the security headers for https://mycompany.com and give me a grade, score, and breakdown of which headers are missing or misconfigured?","exampleUseCases":null,"resultDescription":"A JSON object containing a letter grade (e.g. 'B'), numeric score (e.g. 78), per-header results (present/absent, pass/warn/fail/info, raw value, reason), a summary count of pass/warn/fail/info, detected anti-patterns (e.g. X-Powered-By leakage), score deductions with reasons, the final resolved URL, HTTP status code, content type, and a processing duration in milliseconds.","failureModes":["Target URL is unreachable or times out — returns an error array with connection failure details","Invalid or malformed target URL — likely returns a validation error","Target returns a non-HTTP scheme — unsupported input type","Network-level block (firewall, CAPTCHA) prevents header retrieval — may return partial or error result","Payment not completed — x402 payment required error before analysis runs"],"whenToPreferThis":"Use this endpoint when you need a structured, machine-readable audit of HTTP security headers for any public URL or domain, including per-header grading, anti-pattern detection, and a normalized score. Prefer this over manual header inspection or generic HTTP clients when you need actionable security posture data with letter grades and deduction explanations in a single API call.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-11T06:45:07.442Z","isFirstParty":false,"canonicalSlug":"netintel-security-headers-analyzer-1532af36"}