# HTTP Security Headers Audit

> HTTP Security Headers Audit is a paid API for AI agents from api.x402node.dev, paid per call via x402, $0.008/call, status unknown (last checked 2026-09-14).

Fetches HTTP response headers for a given URL and returns a security audit including HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy, along with a security score (0–100) and list of missing headers.

## Facts

- Endpoint: GET https://api.x402node.dev/web/headers
- Price: $0.008/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/api-x402node-dev-d4feec06
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_hLKfQI0gODSbOoe_Wphyw

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability api-x402node-dev-d4feec06
```

Example prompt: Can you audit the security headers for https://example.com and tell me the security score, which headers are missing, and whether HSTS and CSP are properly configured?

## When to prefer this

Use this endpoint when you need a quick, automated security header audit for any public URL, especially for compliance checks, security reviews, or when building dashboards that track header hygiene across multiple sites. Prefer this over manual browser inspection or full vulnerability scanners when you only need header-level analysis.

## Known failure modes

- Invalid or unreachable URL returns an error with no headers or score
- Timeout if the target server is slow to respond
- Non-HTTPS URLs may lack HSTS by design, reflected in low score
- Redirects may result in headers from the final destination, not the original URL

## How this service works

Fetch URL and return all HTTP response headers plus security audit (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy). Returns security_score 0-100 and missing headers list. Built for security agents and compliance audits. Use url param Accepts payment on Base or Solana — either network works.

## Output

Returns all HTTP response headers from the target URL, a security_score between 0 and 100, and a list of missing security headers from the standard set: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "properties": {
      "url": {
       "type": "string",
       "description": "Target URL (optional)"
      }
     }
    }
   },
   "additionalProperties": false
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/api-x402node-dev-d4feec06/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.x402node.dev](https://www.zero.xyz/host/api.x402node.dev/llms.txt)