# HTTP Security Headers Checker

> HTTP Security Headers Checker is a paid API for AI agents from api.strale.io, paid per call via x402, $0.054001/call, status unknown (last checked 2026-09-15).

Checks a URL's HTTP response headers for security best practices (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) and returns a letter grade A–F.

## Facts

- Endpoint: GET https://api.strale.io/x402/header-security-check
- Price: $0.054001/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/api-strale-io-8c4e4dbf
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_ljusay-klgHF8j4sNnOeA

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability api-strale-io-8c4e4dbf
```

Example prompt: Can you check the security headers on https://myapp.example.com and tell me what grade it gets — specifically whether it has HSTS, CSP, and X-Frame-Options set correctly?

## When to prefer this

Use this endpoint when you need a quick, structured security header audit for a given URL with a clear letter grade and per-header breakdown. Prefer this over a full SEO or accessibility audit when the specific concern is HTTP security posture, particularly for HSTS, CSP, clickjacking protection, and MIME-type sniffing prevention.

## Known failure modes

- Invalid or unreachable URL returns an error or failed check result
- URL uses a non-HTTP scheme (e.g. ftp://) — may not be supported
- Rate limiting or upstream timeout if the target server is slow
- Missing required 'url' query parameter returns a validation error

## How this service works

Check HTTP response headers for security best practices: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. Returns grade A-F.

## Output

Returns a security grade from A to F and a breakdown of whether each key security header (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) is present and correctly configured on the given URL.

## Example request

```json
{
 "url": "https://www.example.com"
}
```

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "required": [
  "url"
 ],
 "properties": {
  "url": {
   "type": "string"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "grade": {
  "type": "string"
 },
 "score": {
  "type": "integer"
 },
 "missing": {
  "type": "array"
 },
 "present": {
  "type": "array"
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/api-strale-io-8c4e4dbf/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.strale.io](https://www.zero.xyz/host/api.strale.io/llms.txt)