# DomainAudit HTTP Security Headers Grader

> DomainAudit HTTP Security Headers Grader is a paid API for AI agents from domainaudit.genexxis.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-29).

Grades a web page A-F on HTTP security headers, returning per-check pass/fail results with current header values and concrete remediation advice.

## Facts

- Endpoint: GET https://domainaudit.genexxis.com/headers?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-29
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/domainaudit-http-security-headers-grader-8cfde7cf
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_BMMY7o_DPH1tjLR9cUD9U

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability domainaudit-http-security-headers-grader-8cfde7cf
```

Example prompt: Can you audit the HTTP security headers on https://acmecorp.com and give me an A-F grade with a fix for each failing check like HSTS, CSP, nosniff, and cookie flags?

## When to prefer this

Choose this endpoint when you need a structured, per-header breakdown with letter grades and actionable fix strings for HTTP security headers specifically. It is more focused than a full-stack domain audit endpoint and cheaper per call; prefer it when you only need header analysis without TLS certificate details, DNS records, or RDAP data. Ideal for CI/CD pipelines, pre-launch checklists, or security review workflows targeting a single URL.

## Known failure modes

- Invalid or unreachable URL returns an error — ensure the target is publicly accessible
- Non-HTTPS URLs may return limited results since some checks require TLS
- DNS resolution failure for the provided hostname results in an error response
- Timeout if the target server is slow to respond
- Paywalled or bot-blocked sites may return unexpected HTTP status codes affecting check accuracy

## How this service works

Deterministic security audit of a website or domain, computed live: HTTP security headers graded A-F with a fix per failed check, TLS certificate and protocol (expiry, chain trust, hostname match, legacy TLS), email anti-spoofing (SPF with recursive DNS-lookup count, DMARC, MTA-STS, TLS-RPT, BIMI, DKIM on common selectors), DNS (A/AAAA/NS/CAA), RDAP registration data, security.txt and robots.txt. The full audit returns a 0-100 score and the top 5 fixes. Also: on-page SEO audit (/seo), a one-call SEO + accessibility + security + registration report (POST /audit/bundle), domain registration + DNS (/domain-info) and bulk RDAP for up to 10 domains (/whois-bulk).

## Output

A JSON object containing the URL, an A-F letter grade, a numeric score, the HTTP status code of the page, and an array of individual checks — each with a check ID (e.g. 'hsts', 'csp', 'x_content_type_options'), a pass/fail boolean, the current header value (or null if absent), and a concrete fix string for failing checks.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "url"
     ],
     "properties": {
      "url": {
       "type": "string",
       "description": "Page URL (https://...) or plain hostname"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "url": "https://example.com/",
  "grade": "F",
  "score": 15,
  "checks": [
   {
    "id": "hsts",
    "fix": "Add Strict-Transport-Security: max-age=31536000; includeSubDomains",
    "pass": false,
    "value": null
   },
   {
    "id": "x_content_type_options",
    "fix": null,
    "pass": true,
    "value": "nosniff"
   }
  ],
  "status": 200
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/domainaudit-http-security-headers-grader-8cfde7cf/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from domainaudit.genexxis.com](https://www.zero.xyz/host/domainaudit.genexxis.com/llms.txt)