{"uid":"cap_RAFNKhsacP5SsBsA3QWoi","slug":"moneytools-security-headers-audit-12cad929","name":"MoneyTools Security Headers Audit","description":"Security headers audit (A-F): Graded audit of HSTS, CSP (unsafe-inline/eval, wildcards), clickjacking, nosniff, Referrer/Permissions-Policy, cookie flags, version leaks and CORS misconfig, with fixes. Free tier 10/day; then $0.002 via x402 (HTTP 402 + PAYMENT-REQUIRED) or X-API-Key credits. Not charged on failure. $0.002 USDC per call via x402 on Base. Run by MoneyTools.","url":"https://tools.moneytools.dev/v1/security-headers?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"const":"http"},"method":{"const":"GET"},"queryParams":{"type":"object","required":["url"],"properties":{"url":{"type":"string","examples":["https://moneytools.dev"],"description":"page URL"}}}}},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string","const":"json"},"example":{"type":"object","properties":{"payment":{"type":"object","properties":{"charged":{"type":"boolean"},"network":{"type":"string"},"amountUsd":{"type":"string"},"transaction":{"type":["string","null"]}}},"freeTier":{"type":"object"},"_moneytools":{"type":"object","description":"optional plan / partner hints"}},"description":"Tool-specific JSON result (see llms.txt / openapi.json). Always includes payment info.","additionalProperties":true}}}}},"responseSchema":{"type":"json"},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_EjVVZnPXwtYI83QdJBl9p","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Audits a URL's HTTP security headers and grades them A–F, checking HSTS, CSP, clickjacking, nosniff, referrer policy, cookie flags, CORS, and version leaks with fix recommendations.","exampleAgentPrompt":"Can you do a full security headers audit on https://myapp.example.com and tell me the grade plus any issues with CSP, HSTS, or cookie flags?","exampleUseCases":[{"title":"Pre-launch security review for SaaS app","prompt":"Before we go live, can you audit the security headers on https://staging.myproduct.io and tell me what grade we get and what we need to fix — especially around CSP and HSTS?"},{"title":"Competitor security posture check","prompt":"What security header grade does https://www.competitor.com get? I want to know if they have clickjacking protection, proper CSP, and whether they're leaking server version info."},{"title":"Compliance check for client website","prompt":"Can you run a security headers audit on https://clientsite.org and give me the full breakdown — HSTS, cookie flags, CORS config, referrer policy — so I can include the findings in my security report?"}],"resultDescription":"A JSON object containing an A–F security grade and detailed findings for each header category: HSTS presence and configuration, CSP analysis (unsafe-inline, eval, wildcard usage), clickjacking (X-Frame-Options), X-Content-Type-Options (nosniff), Referrer-Policy, Permissions-Policy, cookie security flags (Secure, HttpOnly, SameSite), CORS misconfiguration indicators, and server version leak signals — along with actionable fix recommendations for each issue found. Also includes payment metadata (charged boolean, network, amount, transaction ID).","failureModes":["Target URL is unreachable or returns a non-HTTP error — not charged","Invalid or malformed URL input — returns error without charge","Target site blocks requests from audit tools — headers may be incomplete","Free tier (10/day) exhausted and no payment method provided — returns HTTP 402","Network timeout reaching the target URL"],"whenToPreferThis":"Choose this endpoint when you need a quick, structured, graded audit of a URL's HTTP response security headers with specific findings and fixes — especially for HSTS, CSP, clickjacking, cookie flags, and CORS. It is ideal for CI/CD pipeline checks, pre-launch reviews, compliance reporting, or competitive analysis. Prefer this over manual header inspection tools when you need machine-readable results with an overall grade and per-header recommendations in a single call.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-11-05T12:43:20.015Z","isFirstParty":false,"canonicalSlug":"moneytools-security-headers-audit-12cad929"}