{"uid":"cap_uMeZNaVYGo0zAClcAloe5","slug":"sitecheck-security-headers-audit-3d7430e1","name":"SiteCheck Security Headers Audit","description":"Security headers of a URL's final response: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options (or CSP frame-ancestors), X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy, each with present, value, ok and advice. Also cookies missing Secure, HttpOnly or SameSite (names only), version leaks in Server or X-Powered-By, and a grade from A to F.","url":"https://api.sitecheck-api.workers.dev/api/headers?utm_source=zero.xyz","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["url"],"properties":{"url":{"type":"string","description":"Page URL or domain, e.g. example.com"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"url":"https://example.com/","grade":"D","leaks":[{"value":"nginx/1.25.3","header":"server"}],"score":4,"status":200,"cookies":{"count":1,"withoutFlags":[{"name":"session","missing":["Secure","SameSite"]}]},"headers":{"contentSecurityPolicy":{"ok":false,"value":null,"advice":"add a Content-Security-Policy with default-src","present":false},"strictTransportSecurity":{"ok":true,"value":"max-age=31536000","advice":"ok","present":true}},"finalUrl":"https://example.com/","checkedAt":"2026-10-13T09:00:00.000Z"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.001","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.001/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.001","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_HygVsdzPqDnU2TIitdIFa","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.001","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Analyzes a website's HTTP security headers, returning a grade, score, header presence/advice, cookie flags, and information leakage for a given URL.","exampleAgentPrompt":"Can you audit the security headers on https://mycompany.com and tell me what grade it gets, which headers are missing, and whether it's leaking any server version info?","exampleUseCases":[{"title":"Pre-launch security header review","prompt":"Before we go live, can you check the security headers on https://staging.myapp.com and tell me the grade, what headers are missing, and any advice on what to fix?"},{"title":"Cookie flag compliance check","prompt":"I need to know if the cookies on https://shop.example.com have the Secure and SameSite flags set — can you run a security header audit and flag any cookies that are missing those?"},{"title":"Server information leakage detection","prompt":"Does https://api.acmecorp.com leak any server version information in its HTTP headers? Run a security headers check and tell me if anything sensitive is being exposed."}],"resultDescription":"Returns a JSON object with the final URL, an overall letter grade (e.g. A–F), a numeric score, HTTP status, a list of information leaks (e.g. server version strings), a breakdown of specific security headers (CSP, HSTS, etc.) each with present/ok/value/advice fields, and a cookie analysis including count and cookies missing Secure or SameSite flags.","failureModes":["Invalid or unreachable URL returns error or non-200 status","Timeout if the target domain is slow or unresponsive","Redirect loops may result in unexpected finalUrl","Non-HTTP URLs (e.g. FTP) are not supported","Private/intranet URLs may not be accessible from the audit worker"],"whenToPreferThis":"Choose this endpoint when you need a structured, graded audit of a website's HTTP security headers including CSP, HSTS, cookie flags, and server information leakage — especially when you want actionable advice per header rather than just raw header values. Prefer it over generic HTTP fetch tools when you need a security score and per-header remediation guidance in a single call.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-10-18T06:42:58.271Z","isFirstParty":false,"canonicalSlug":"sitecheck-security-headers-audit-3d7430e1"}