{"uid":"cap_jlqUPPfVW8YOI2Fp1O-CR","slug":"http-security-headers-grader-c261d9e4","name":"HTTP Security Headers Grader","description":"Fetch a public URL and grade its HTTP security headers: HSTS, Content-Security-Policy, framing protection, nosniff, Referrer-Policy and Permissions-Policy, plus version leaks (Server, X-Powered-By) and cookies missing Secure, HttpOnly or SameSite. Returns a grade A-F, a score and each check with its value. Use to review a site's basic web security; for DNS and email records use domain. Private hosts are refused with 400, uncharged.","url":"https://agent-data-tools.revmesh2074.workers.dev/http/security-headers?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["url"],"properties":{"url":{"type":"string","examples":["https://example.com"],"description":"Public http(s) URL to check"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object","properties":{"url":{"type":"string"},"grade":{"type":"string"},"score":{"type":"number"},"checks":{"type":"array","items":{"type":"object","properties":{"note":{"type":"string"},"value":{},"header":{"type":"string"},"status":{"type":"string"}}}},"status":{"type":"number"},"finalUrl":{"type":"string"}}}}}}},"responseSchema":{"type":"json","example":{"url":"https://example.com","grade":"C","score":60,"checks":[{"note":"missing: browsers may load the site over plain HTTP","value":null,"header":"strict-transport-security","status":"fail"}],"status":200,"finalUrl":"https://example.com/"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.01","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.01/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.01","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_usVmTrGio0EHaNNfR-Te3","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.01","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Fetches a public URL and grades its HTTP security headers (HSTS, CSP, framing, nosniff, Referrer-Policy, Permissions-Policy, version leaks, cookie flags), returning an A–F letter grade, numeric score, and per-check details.","exampleAgentPrompt":"Can you audit the HTTP security headers for https://www.example.com and tell me what grade it gets, which headers are missing or misconfigured, and whether there are any version leaks or cookie flag issues?","exampleUseCases":[{"title":"Pre-launch security header review","prompt":"We're about to launch our new site at https://staging.myapp.io — can you check its HTTP security headers and tell me what grade it gets and what we need to fix before going live?"},{"title":"Compliance audit for client site","prompt":"I need to audit https://www.clientbusiness.com for basic web security headers — HSTS, CSP, framing protection, cookie flags, the works. Give me the grade and a breakdown of every check."},{"title":"Detect server version information leaks","prompt":"Can you check if https://shop.mybrand.com is leaking any server or framework version info in its HTTP headers, and while you're at it, give me the full security header grade?"}],"resultDescription":"Returns a JSON object with the final URL fetched, an A–F letter grade, a numeric score, and an array of individual checks — each with the header name, its value, a pass/warn/fail status, and an explanatory note. Private/internal hosts are rejected with HTTP 400 without charge.","failureModes":["Private or non-routable host provided — returns 400, no charge","URL is unreachable or times out — returns an error status","Malformed URL input — validation error","Site returns non-standard responses that prevent header analysis"],"whenToPreferThis":"Use this endpoint when you need a quick, structured audit of a website's HTTP response security headers without setting up local tooling. It's ideal for pre-launch checklists, compliance reviews, or agent workflows that need a machine-readable security grade. For DNS records, MX/SPF/DKIM email security, or WHOIS data, use the companion /domain endpoint instead.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-20T20:47:32.575Z","isFirstParty":false,"canonicalSlug":"http-security-headers-grader-c261d9e4"}