{"uid":"cap_V5e7vpZHK4kLQWDR28C6H","slug":"http-security-headers-grader-4c33da7a","name":"HTTP Security Headers Grader","description":"Fetches a public http(s) URL (GET, up to 5 redirects, 10s timeout, body never read) and grades its security headers A+ to F. Returns score, present and missing headers, per-header findings with copy-paste fix values, and cookie flag issues.","url":"https://http-security-headers-grade.x402supply.com/tools/grade_headers?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","properties":{"url":{"type":"string","maxLength":2048,"minLength":4,"description":"Public http or https URL to grade, e.g. https://github.com"}}},"responseSchema":{"type":"json","example":{"url":"https://example.com","fixes":{"referrer-policy":"Referrer-Policy: strict-origin-when-cross-origin","x-frame-options":"X-Frame-Options: DENY","permissions-policy":"Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()","x-content-type-options":"X-Content-Type-Options: nosniff","content-security-policy":"Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'","strict-transport-security":"Strict-Transport-Security: max-age=63072000; includeSubDomains; preload","cross-origin-opener-policy":"Cross-Origin-Opener-Policy: same-origin","cross-origin-embedder-policy":"Cross-Origin-Embedder-Policy: require-corp","cross-origin-resource-policy":"Cross-Origin-Resource-Policy: same-origin"},"grade":"F","score":0,"status":200,"cookies":[],"missing":["strict-transport-security","content-security-policy","x-frame-options","x-content-type-options","referrer-policy","permissions-policy","cross-origin-opener-policy","cross-origin-embedder-policy","cross-origin-resource-policy"],"present":[],"finalUrl":"https://example.com/","findings":[{"fix":"Strict-Transport-Security: max-age=63072000; includeSubDomains; preload","value":null,"header":"strict-transport-security","points":0,"status":"fail","message":"HSTS header is missing.","maxPoints":18},{"fix":"Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'","value":null,"header":"content-security-policy","points":0,"status":"fail","message":"Content-Security-Policy is missing.","maxPoints":25},{"fix":"X-Frame-Options: DENY","value":null,"header":"x-frame-options","points":0,"status":"fail","message":"No X-Frame-Options or CSP frame-ancestors, so the page can be framed (clickjacking).","maxPoints":10},{"fix":"X-Content-Type-Options: nosniff","value":null,"header":"x-content-type-options","points":0,"status":"fail","message":"X-Content-Type-Options is missing.","maxPoints":10},{"fix":"Referrer-Policy: strict-origin-when-cross-origin","value":null,"header":"referrer-policy","points":0,"status":"fail","message":"Referrer-Policy is missing.","maxPoints":10},{"fix":"Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()","value":null,"header":"permissions-policy","points":0,"status":"fail","message":"Permissions-Policy is missing.","maxPoints":8},{"fix":"Cross-Origin-Opener-Policy: same-origin","value":null,"header":"cross-origin-opener-policy","points":0,"status":"fail","message":"Cross-Origin-Opener-Policy is missing.","maxPoints":5},{"fix":"Cross-Origin-Embedder-Policy: require-corp","value":null,"header":"cross-origin-embedder-policy","points":0,"status":"fail","message":"Cross-Origin-Embedder-Policy is missing.","maxPoints":4},{"fix":"Cross-Origin-Resource-Policy: same-origin","value":null,"header":"cross-origin-resource-policy","points":0,"status":"fail","message":"Cross-Origin-Resource-Policy is missing.","maxPoints":4}],"redirects":0}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_NswCkjg4oUK75Jjqn2i7S","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Fetches a public URL and grades its HTTP security headers from A+ to F, returning a score, present/missing headers, per-header findings with fix recommendations, and cookie flag issues.","exampleAgentPrompt":"Can you check the HTTP security headers for https://mycompany.com and give me a grade, tell me which headers are missing, and show me the copy-paste fixes I need to add?","exampleUseCases":[{"title":"Pre-launch security header audit","prompt":"Before we go live, can you grade the security headers on https://staging.myapp.com and list everything missing so we can fix it before launch?"},{"title":"Competitor security posture benchmarking","prompt":"I want to compare our security headers against a competitor — can you grade https://www.competitor.com and tell me their score and what they're doing right or wrong?"},{"title":"Ongoing compliance monitoring","prompt":"Can you check https://api.myservice.io and tell me if we have all the important security headers in place, including proper cookie flags, and what grade we get?"}],"resultDescription":"Returns a letter grade (A+ to F), a numeric security score, lists of present and missing security headers, per-header findings with copy-paste ready fix values, and any cookie flag issues detected on the given URL.","failureModes":["URL is unreachable or times out after 10 seconds","URL requires authentication or is not publicly accessible","Redirect chain exceeds 5 hops","Invalid or malformed URL provided","Non-HTTP/HTTPS scheme provided","Target server returns no headers or an error status"],"whenToPreferThis":"Choose this endpoint when you need a quick, structured security header audit of any public web URL — especially useful for getting actionable, copy-paste fix values per header and a standardized A+ to F grade. Prefer it over manual header inspection tools when you want machine-readable findings with remediation guidance in a single API call.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-30T07:03:06.880Z","isFirstParty":false,"canonicalSlug":"http-security-headers-grader-4c33da7a"}