{"uid":"cap_KSjmUIByhheYEwPuHH-OU","slug":"http-response-headers-inspector-88f8210a","name":"HTTP Response Headers Inspector","description":"HTTP response headers inspector and security grader. Fetches headers from any public URL and evaluates OWASP-recommended security headers: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. Returns raw headers, per-header security findings, overall grade (A–F), and actionable recommendations. Useful for web app security audits, CDN configuration verification, and compliance checks.","url":"https://the-stall.intuitek.ai/cap/http-headers","method":"GET","headers":{},"bodySchema":{"type":"object","properties":{"required":{"type":"string"},"properties":{"type":"string"}}},"responseSchema":null,"example":{"request":{"input":{"type":"http","method":"GET","queryParams":{"url":"https://www.example.com","include_all_headers":false}}},"response":{"ts":"2026-06-12T05:11:24.570Z","url":"https://www.example.com/","server":"cloudflare","findings":[{"tip":"Add HSTS with max-age >= 31536000 and includeSubDomains.","value":null,"header":"HSTS","result":"fail","present":false},{"tip":"Define a Content-Security-Policy with at least default-src.","value":null,"header":"CSP","result":"fail","present":false},{"tip":"Add X-Frame-Options: DENY or SAMEORIGIN to prevent clickjacking.","value":null,"header":"X-Frame-Options","result":"fail","present":false},{"tip":"Set X-Content-Type-Options: nosniff.","value":null,"header":"X-Content-Type-Options","result":"fail","present":false},{"tip":"Add Referrer-Policy (e.g. strict-origin-when-cross-origin).","value":null,"header":"Referrer-Policy","result":"fail","present":false},{"tip":"Add Permissions-Policy to restrict browser features (camera, geolocation, etc.).","value":null,"header":"Permissions-Policy","result":"fail","present":false},{"tip":"Deprecated — CSP is preferred. If present, '1; mode=block' is safest.","value":null,"header":"X-XSS-Protection","result":"info","present":false}],"all_headers":{"age":"687","date":"Fri, 12 Jun 2026 05:11:24 GMT","allow":"GET, HEAD","cf-ray":"a0a65ac70a31d30c-MCI","server":"cloudflare","connection":"close","content-type":"text/html","last-modified":"Tue, 09 Jun 2026 21:01:00 GMT","cf-cache-status":"HIT","content-encoding":"br"},"status_code":200,"cdn_detected":"Cloudflare","security_grade":{"max":12,"score":0,"letter":"F"}}},"exampleRequest":{"url":"https://www.example.com","include_all_headers":false},"tags":["x402"],"displayCostAmount":"0.023","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.023/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.023","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.023","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_pziwKjhk8ESK-Wpe6kBrR","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.023","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Fetches and returns the HTTP response headers of a given public URL, optionally filtered to security-relevant headers only","exampleAgentPrompt":"Can you fetch the HTTP response headers from https://example.com and show me just the security-relevant ones like CSP, HSTS, X-Frame-Options, and CORS headers?","exampleUseCases":null,"resultDescription":"A structured set of HTTP response headers returned by the target URL, either only security-relevant headers (default) or all response headers if include_all_headers is true. Includes headers like Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Access-Control-Allow-Origin, Server, etc.","failureModes":["URL is unreachable or times out — returns an error indicating the host could not be contacted","URL is not a valid public HTTP/HTTPS address (e.g. private/internal IPs) — rejected with validation error","Target server returns no headers or an unexpected protocol — partial or empty header set returned","Redirect chain is too deep or circular — may fail or return headers from final redirect target","Malformed URL input — returns a parsing error"],"whenToPreferThis":"Use this endpoint when you need to programmatically inspect a website's HTTP response headers, especially for security auditing (checking for HSTS, CSP, CORS, X-Frame-Options, etc.) or server fingerprinting. It requires no API keys, is pay-per-use via USDC on Base, and is ideal for one-off checks or automated security scans of public URLs.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-13T12:58:14.693Z","isFirstParty":false}