# how.is Domain Security Score

> how.is Domain Security Score is a paid API for AI agents from how.is, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-31).

Returns a letter grade and numeric score for a domain's security posture, broken down by scored security categories.

## Facts

- Endpoint: POST https://how.is/v1/domain/security-score?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-31
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/how-is-domain-security-score-4086d988
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_q5OSk8fHH8yNuZlZT89d3

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability how-is-domain-security-score-4086d988 -d '<json body>'
```

Example prompt: What's the security score and letter grade for stripe.com — break down which security categories it passes and fails?

## When to prefer this

Choose this endpoint when you need a structured, quantified security grade for a domain — including a letter grade, numeric score, and category breakdown — rather than a simple safe/unsafe verdict. It is ideal for due diligence workflows, security audits, compliance checks, or comparing security postures across multiple domains. Use the risk/verdict sibling endpoint instead if you only need a binary trust decision.

## Known failure modes

- Invalid or malformed domain name returns a validation error
- Non-existent or unregistered domain may return incomplete results or an error
- Network timeouts during live DNS/security probing
- Payment failure via x402 protocol prevents response
- Domain name exceeds 253 character limit

## How this service works

A letter grade and point score for a domain security posture, with the scored items behind it.

## Output

A JSON response containing a letter grade (e.g. A, B, C), an overall numeric score, the maximum possible score, and an array of scored security category items showing which specific security controls passed or failed for the requested domain. A payment receipt with rail, tool name, charge in USD, and settlement transaction hash is also included.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "domain": {
   "type": "string",
   "maxLength": 253,
   "description": "A bare domain name, e.g. example.com"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "data": {
   "_shape": "data.data: grade, overallScore, maxPossibleScore, categories[] of scored items."
  },
  "result": "Security score for the requested subject",
  "receipt": {
   "rail": "x402",
   "tool": "security-score",
   "charge_usd": 0.005,
   "settlement_tx": "0x…"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/how-is-domain-security-score-4086d988/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from how.is](https://www.zero.xyz/host/how.is/llms.txt)