{"uid":"cap_j6G8_3JFEBwuZUXotK8Bp","slug":"2s-http-security-headers-analyzer-a01d5a8a","name":"2s HTTP Security Headers Analyzer","description":"Fetch a URL and grade its HTTP security headers. Pass url (scheme optional — defaults to https). Returns an overall letter grade + score, the list of present/missing headers, and a per-header analysis with the live value and specific issues for: Strict-Transport-Security (HSTS max-age/includeSubDomains), Content-Security-Policy (flags 'unsafe-inline'/'unsafe-eval'/missing default-src), X-Frame-Options or CSP frame-ancestors (clickjacking), X-Content-Type-Options (nosniff), Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener/Resource-Policy. Also flags Server/X-Powered-By info disclosure. Analyzed from the target's LIVE response headers through an SSRF-guarded fetch (private/loopback targets refused) — an LLM cannot see a site's current headers. For web-app security review, vendor assessment, and CI gates.","url":"https://2s.io/api/security/http-headers","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method","queryParams"],"properties":{"type":{"const":"http"},"method":{"const":"GET"},"queryParams":{"required":["url"],"properties":{"url":{"type":"string","description":"URL to analyze (scheme optional)."}}}}}}},"responseSchema":null,"example":{"request":{"input":{"type":"http","method":"GET","queryParams":{"url":"https://example.com"}}},"response":{"data":{"ok":true,"items":[{"url":"https://example.com/","note":"Graded from the target’s live HTTP response headers (SSRF-guarded fetch). Private/loopback targets are refused.","grade":"F","score":0,"source":{"url":"https://2s.io/security/http-headers","license":"Computed by 2s.io from the target’s live HTTP response headers.","provider":"2s.io HTTP security-header analyzer (live fetch)"},"status":200,"headers":[{"value":null,"header":"strict-transport-security","issues":["missing HSTS"],"weight":3,"present":false},{"value":null,"header":"content-security-policy","issues":["missing CSP"],"weight":3,"present":false},{"value":null,"header":"x-frame-options","issues":["no X-Frame-Options and no CSP frame-ancestors (clickjacking risk)"],"weight":2,"present":false},{"value":null,"header":"x-content-type-options","issues":["missing x-content-type-options"],"weight":2,"present":false},{"value":null,"header":"referrer-policy","issues":["missing referrer-policy"],"weight":1,"present":false},{"value":null,"header":"permissions-policy","issues":["missing permissions-policy"],"weight":1,"present":false},{"value":null,"header":"cross-origin-opener-policy","issues":["missing cross-origin-opener-policy"],"weight":1,"present":false},{"value":null,"header":"cross-origin-resource-policy","issues":["missing cross-origin-resource-policy"],"weight":1,"present":false}],"missing":["strict-transport-security","content-security-policy","x-frame-options","x-content-type-options","referrer-policy","permissions-policy","cross-origin-opener-policy","cross-origin-resource-policy"],"present":[],"finalUrl":"https://example.com/","maxScore":14,"infoDisclosure":{"server":"cloudflare","xPoweredBy":null}}],"total":1,"source":{"url":"https://2s.io/security/http-headers","license":"Computed by 2s.io from the target’s live HTTP response headers.","provider":"2s.io HTTP security-header analyzer (live fetch)"}},"meta":{"cost":{"usd":0.0018,"tier":0},"caller":"x402","version":null,"endpoint":"security.http-headers","settlement":{"txHash":"0x009aae1757002304700e0bf4285f76be3d0d817cf3c889c578509c8f93c24785","network":"eip155:8453","success":true}}}},"exampleRequest":{"url":"https://example.com"},"tags":["x402"],"displayCostAmount":"0.0018","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.0018/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.0045","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.0045","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_QehGPbHlTs_U7j9_TF1o-","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.0045","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Fetches a URL's live HTTP response headers and grades them for security best practices, returning a letter grade, score, and per-header analysis.","exampleAgentPrompt":"Can you check the HTTP security headers on https://example.com and tell me what grade it gets, what's missing, and whether it's leaking any server info?","exampleUseCases":null,"resultDescription":"Returns a JSON object with ok status, an array of items each containing: the analyzed URL, a letter grade (e.g. 'C'), a numeric score and max score, HTTP status code, per-header breakdown with issues and presence flags, lists of missing and present security headers, the final redirect URL, and any server/x-powered-by info disclosure found.","failureModes":["Invalid or unreachable URL returns error or non-200 status","URL with no scheme may still resolve but could cause ambiguous results","Sites behind CAPTCHA or bot protection may return unexpected headers","Payment failure (402) if USDC balance insufficient","Timeout if target URL is slow to respond"],"whenToPreferThis":"Use this endpoint when you need a live, real-time audit of a specific URL's HTTP security headers — including grade, score, per-header issues, and info disclosure — without signing up or managing API keys. Prefer over static scanners when you need ground-truth data from the actual live response.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T07:00:46.201Z","isFirstParty":false}