{"uid":"cap_M0XiGCIX9o_M3i-rzGFt-","slug":"tanod-web-http-security-headers-grader-d1f65974","name":"Tanod Web HTTP Security Headers Grader","description":"Web tools: search, page to Markdown or screenshot, company profile and jobs, sitemaps, RDAP, IP.","url":"https://web.tanod.dev/v1/headers?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"url":{"type":"string","maxLength":2048,"minLength":1,"description":"Public http(s) URL whose response headers are graded (the final response after redirects)."}}},"responseSchema":{"type":"json","example":{"csp":{"value":"default-src 'none'; base-uri 'self'; child-src github.githubassets.com ...","present":true,"policies":1,"directives":["base-uri","child-src","connect-src","default-src","font-src","form-action","frame-ancestors","frame-src","img-src","manifest-src","media-src","script-src","style-src","upgrade-insecure-requests","worker-src"],"report_only":false,"unsafe_eval":false,"unsafe_inline":false,"frame_ancestors":"'none'","wildcard_sources":false,"missing_directives":[],"scripts_restricted":true,"object_src_restricted":true},"url":"https://github.com","hsts":{"valid":true,"value":"max-age=31536000; includeSubdomains; preload","max_age":31536000,"preload":true,"present":true,"preload_eligible":true,"include_subdomains":true},"note":"one response's headers only; pages, APIs and error responses of the same site can differ","grade":"A","https":true,"score":90,"status":200,"cookies":{"count":3,"items":[{"name":"_gh_sess","secure":true,"httponly":true,"samesite":"Lax","host_prefix":false,"secure_prefix":false},{"name":"_octo","secure":true,"httponly":false,"samesite":"Lax","host_prefix":false,"secure_prefix":false}],"truncated":false},"final_url":"https://github.com","redirects":[],"deductions":[{"code":"permissions_policy_missing","points":5,"reason":"no Permissions-Policy header"},{"code":"cookie_not_httponly","points":5,"reason":"1 cookie(s) without HttpOnly (fine only if scripts must read them)"}],"disclosure":{"server":"github.com","x_powered_by":null,"x_aspnet_version":null},"cross_origin":{"opener_policy":null,"embedder_policy":null,"resource_policy":null},"referrer_policy":{"note":null,"value":"origin-when-cross-origin, strict-origin-when-cross-origin","effective":"strict-origin-when-cross-origin"},"x_frame_options":{"valid":true,"value":"DENY"},"untrusted_content":true,"upgraded_to_https":false,"permissions_policy":{"value":null,"present":false},"x_content_type_options":{"valid":true,"value":"nosniff"}}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_VdKcO9wIyL-JtLOFZeWeo","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Fetches and analyzes the HTTP response headers of a given URL, grading its security posture across CSP, HSTS, cookies, framing protections, and more.","exampleAgentPrompt":"Can you check the security headers for https://example.com and tell me the overall grade, whether HSTS and CSP are configured properly, and what deductions are bringing the score down?","exampleUseCases":[{"title":"Pre-launch security audit","prompt":"We're about to launch our new site at https://app.mycompany.com — can you grade its HTTP security headers and tell me what's missing or misconfigured before we go live?"},{"title":"Competitor security benchmarking","prompt":"I want to compare how well https://stripe.com has hardened its HTTP headers — what's their security grade, do they have a strong CSP, and are their cookies properly secured?"},{"title":"Bug bounty recon check","prompt":"I'm doing a security review on https://portal.targetsite.com — can you pull its response headers, score them, and flag any missing directives like Permissions-Policy or unsafe CSP settings?"}],"resultDescription":"Returns a structured JSON object with an overall letter grade (e.g. 'A'), numeric score, HTTPS status, final URL after redirects, redirect chain, CSP analysis (directives, unsafe-eval/inline flags, missing directives), HSTS details (max-age, preload, includeSubdomains), cookie attributes (secure, HttpOnly, SameSite), X-Frame-Options, Referrer-Policy, Permissions-Policy presence, Cross-Origin policies, server disclosure headers, and a list of scored deductions explaining why points were lost.","failureModes":["Non-public or unreachable URLs return an error (e.g. localhost, private IPs)","URLs exceeding 2048 characters are rejected","Sites with connection timeouts or SSL errors may fail to return headers","Some servers return minimal headers, resulting in many deductions but a valid response","Only the final response headers are graded; other paths on the same site may differ"],"whenToPreferThis":"Choose this endpoint when you need a detailed, scored breakdown of HTTP security headers for a specific URL — including CSP, HSTS, cookies, and framing policies — rather than just fetching raw headers. It is ideal for security audits, pre-launch checklists, developer hardening reviews, and benchmarking sites against best practices. Prefer this over generic HTTP inspection tools when you need an actionable grade with specific deductions and explanations.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-13T12:45:53.007Z","isFirstParty":false,"canonicalSlug":"tanod-web-http-security-headers-grader-d1f65974"}