{"uid":"cap_iiqYu8rkfzIMXy9fHrE7b","slug":"http-security-headers-audit-4fdfb728","name":"HTTP Security Headers Audit","description":"Use when you need an http security headers audit of a website or URL, with a grade and what to fix. Do not use for vulnerability scans, TLS cipher analysis or pages behind a login. Returns JSON auditing the HTTP security headers of a public URL (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cookies) with a grade and fixes for 0.007 USDC per call. Typical response time 2500 ms (p95). Category: Infrastructure.","url":"https://x402-gateway.blackwoodstate8.workers.dev/v1/http-headers?utm_source=zero.xyz","method":"POST","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","bodyType","body"],"properties":{"body":{"type":"object","required":["url"],"properties":{"url":{"type":"string","maxLength":2048,"minLength":8,"description":"Public http(s) URL to audit, e.g. https://example.com"}}},"type":{"type":"string","const":"http"},"method":{"enum":["POST"],"type":"string"},"bodyType":{"enum":["json","form-data","text"],"type":"string"}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","required":["url","finalUrl","status","redirects","grade","score","checks","cookies","checkedAt"],"properties":{"url":{"type":"string"},"next":{"type":"object","required":["service","tool","method","url","useWhen","sample"],"properties":{"url":{"type":"string","description":"Paid route of the next call"},"tool":{"type":"string","description":"MCP tool name of the same call"},"method":{"enum":["GET","POST"],"type":"string"},"sample":{"type":"string","description":"Free fixed sample of the whole family"},"service":{"type":"string","description":"Service id of the suggested next paid call"},"useWhen":{"type":"string","description":"When the next call is the right one"}},"description":"Suggested next paid call in the same family (call it in a loop when the task continues)","additionalProperties":false},"grade":{"type":"string"},"score":{"type":"number"},"checks":{"type":"array","items":{"type":"object","required":["header","result","value","advice"],"properties":{"value":{"type":["string","null"]},"advice":{"type":"string"},"header":{"type":"string"},"result":{"enum":["pass","warn","fail","info"],"type":"string"}},"additionalProperties":false}},"status":{"type":"number"},"cookies":{"type":"array","items":{"type":"object","required":["name","secure","httpOnly","sameSite"],"properties":{"name":{"type":"string"},"secure":{"type":"boolean"},"httpOnly":{"type":"boolean"},"sameSite":{"type":["string","null"]}},"additionalProperties":false}},"finalUrl":{"type":"string"},"checkedAt":{"type":"string"},"redirects":{"type":"number"}},"additionalProperties":false}}}}},"responseSchema":{"type":"json","example":{"url":"https://example.com","grade":"F","score":10,"checks":[{"value":null,"advice":"Add Strict-Transport-Security: max-age=31536000; includeSubDomains","header":"strict-transport-security","result":"fail"},{"value":null,"advice":"Add a Content-Security-Policy; start with default-src 'self' and tighten from there.","header":"content-security-policy","result":"fail"},{"value":null,"advice":"Add X-Frame-Options: DENY (or CSP frame-ancestors 'none') against clickjacking.","header":"x-frame-options","result":"fail"},{"value":null,"advice":"Add X-Content-Type-Options: nosniff.","header":"x-content-type-options","result":"fail"},{"value":null,"advice":"Add Referrer-Policy: strict-origin-when-cross-origin.","header":"referrer-policy","result":"warn"},{"value":null,"advice":"Add a Permissions-Policy that turns off features you do not use (camera, microphone, geolocation).","header":"permissions-policy","result":"warn"}],"status":200,"cookies":[],"finalUrl":"https://example.com/","checkedAt":"2026-10-17T16:49:19.296Z","redirects":0}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.007","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"registry","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.007/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.007","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.007","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_4vR_7x6PwNm6l-ceJLXnu","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.007","costPer":"request","priority":0,"asset":null,"unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Audits the HTTP security headers of a public URL, returning a letter grade, score, per-header pass/warn/fail results, and actionable fix advice.","exampleAgentPrompt":"Can you audit the HTTP security headers for https://example.com and tell me what grade it gets, which headers are missing or misconfigured, and what I should fix?","exampleUseCases":[{"title":"Pre-launch security header check","prompt":"Before we go live with our new site at https://staging.myapp.io, can you check all its HTTP security headers and tell me what grade it gets and what we need to fix?"},{"title":"CSP and cookie flag audit for compliance","prompt":"Our security team needs a report on https://shop.mybrand.com — specifically whether the Content-Security-Policy and cookie flags like Secure and HttpOnly are properly set. Can you run an HTTP header audit?"},{"title":"Investigate clickjacking vulnerability","prompt":"I'm worried our site https://portal.mycompany.com might be vulnerable to clickjacking. Can you check whether X-Frame-Options and the relevant security headers are configured correctly and give me a grade?"}],"resultDescription":"Returns a JSON object containing the original URL, final URL after redirects, HTTP status, redirect chain, an overall letter grade (e.g. A, B, C, F) and numeric score, an array of per-header checks each with the header name, raw value, a pass/warn/fail/info result, and fix advice, plus a cookies array showing each cookie's Secure, HttpOnly, and SameSite attributes, and a checkedAt timestamp.","failureModes":["URL is behind a login or authentication wall — audit cannot fetch headers, returns error","URL is not publicly reachable (private network, localhost) — connection failure","URL uses a non-HTTP/HTTPS scheme — rejected by input validation","Malformed or too-short URL fails schema validation (minLength:8)","Target server times out or is slow — may exceed typical 2500ms response window","Payment not processed — x402 payment required error before audit runs"],"whenToPreferThis":"Choose this endpoint when you need a fast, structured HTTP security header audit of any public URL — including grading, per-header pass/fail analysis, cookie security flags, and concrete fix advice. Prefer it over manual header inspection tools when you need machine-readable JSON output for automation or reporting. Do NOT use it for TLS/cipher analysis, full vulnerability scanning, or auditing pages that require authentication.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-22T18:38:27.551Z","isFirstParty":false,"canonicalSlug":"http-security-headers-audit-4fdfb728"}