Tools Grade Headers

Last 30 days

Uptime

100%

Response time

205 ms typical, 328 ms slowest 5%

Last check

44 min ago

Next check

any minute now

How to call it

# See the payment challenge (nothing is charged)
curl -i -X POST "https://http-security-headers-grade.x402supply.com/tools/grade_headers" \
  -H "content-type: application/json" \
  -d '{"url":"https://example.com"}'

import { wrapFetchWithPayment } from "@x402/fetch";
import { x402Client } from "@x402/core/client";
import { ExactEvmScheme } from "@x402/evm/exact/client";
import { privateKeyToAccount } from "viem/accounts";

const client = new x402Client().register(
  "eip155:8453",
  new ExactEvmScheme(privateKeyToAccount(process.env.AGENT_KEY)),
);
const pay = wrapFetchWithPayment(fetch, client);

// Not sure it's safe to pay? Preflight it first for $0.005:
// GET https://toolvet.app/api/v1/check?url=https%3A%2F%2Fhttp-security-headers-grade.x402supply.com%2Ftools%2Fgrade_headers
const res = await pay("https://http-security-headers-grade.x402supply.com/tools/grade_headers", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({"url":"https://example.com"}),
});
console.log(await res.json());

Example input

{
  "url": "https://example.com"
}

Example output

{
  "cookies": [],
  "finalUrl": "https://example.com/",
  "findings": [
    {
      "fix": "Strict-Transport-Security: max-age=63072000; includeSubDomains; preload",
      "header": "strict-transport-security",
      "maxPoints": 18,
      "message": "HSTS header is missing.",
      "points": 0,
      "status": "fail",
      "value": null
    },
    {
      "fix": "Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'",
      "header": "content-security-policy",
      "maxPoints": 25,
      "message": "Content-Security-Policy is missing.",
      "points": 0,
      "status": "fail",
      "value": null
    },
    {
      "fix": "X-Frame-Options: DENY",
      "header": "x-frame-options",
      "maxPoints": 10,
      "message": "No X-Frame-Options or CSP frame-ancestors, so the page can be framed (clickjacking).",
      "points": 0,
      "status": "fail",
      "value": null
    },
    {
      "fix": "X-Content-Type-Options: nosniff",
      "header": "x-content-type-options",
      "maxPoints": 10,
      "message": "X-Content-Type-Options is missing.",
      "points": 0,
      "status": "fail",
      "value": null
    },
    {
      "fix": "Referrer-Policy: strict-origin-when-cross-origin",
      "header": "referrer-policy",
      "maxPoints": 10,
      "message": "Referrer-Policy is missing.",
      "points": 0,
      "status": "fail",
      "value": null
    },
    {
      "fix": "Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()",
      "header": "permissions-policy",
      "maxPoints": 8,
      "message": "Permissions-Policy is missing.",
      "points": 0,
      "status": "fail",
      "value": null
    },
    {
      "fix": "Cross-Origin-Opener-Policy: same-origin",
      "header": "cross-origin-opener-policy",
      "maxPoints": 5,
      "message": "Cross-Origin-Opener-Policy is missing.",
      "points": 0,
      "status": "fail",
      "value": null
    },
    {
      "fix": "Cross-Origin-Embedder-Policy: require-corp",
      "header": "cross-origin-embedder-policy",
      "maxPoints": 4,
      "message": "Cross-Origin-Embedder-Policy is missing.",
      "points": 0,
      "status": "fail",
      "value": null
    },
    {
      "fix": "Cross-Origin-Resource-Policy: same-origin",
      "header": "cross-origin-resource-policy",
      "maxPoints": 4,
      "message": "Cross-Origin-Resource-Policy is missing.",
      "points": 0,
      "status": "fail",
      "value": null
    }
  ],
  "fixes": {
    "content-security-policy": "Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'",
    "cross-origin-embedder-policy": "Cross-Origin-Embedder-Policy: require-corp",
    "cross-origin-opener-policy": "Cross-Origin-Opener-Policy: same-origin",
    "cross-origin-resource-policy": "Cross-Origin-Resource-Policy: same-origin",
    "permissions-policy": "Permissions-Policy: camera=(), micropho

Security scan

• No findings. We scan names, descriptions and tool definitions for hidden instructions and other prompt-injection patterns.

Recent checks