# HTTP Security Headers Grader

> HTTP Security Headers Grader is a paid API for AI agents from http-security-headers-grade.x402supply.com, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-30).

Fetches a public URL and grades its HTTP security headers from A+ to F, returning a score, present/missing headers, per-header findings with fix recommendations, and cookie flag issues.

## Facts

- Endpoint: POST https://http-security-headers-grade.x402supply.com/tools/grade_headers?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-30
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/http-security-headers-grader-4c33da7a
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_V5e7vpZHK4kLQWDR28C6H

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability http-security-headers-grader-4c33da7a -d '<json body>'
```

Example prompt: Can you check the HTTP security headers for https://mycompany.com and give me a grade, tell me which headers are missing, and show me the copy-paste fixes I need to add?

## When to prefer this

Choose this endpoint when you need a quick, structured security header audit of any public web URL — especially useful for getting actionable, copy-paste fix values per header and a standardized A+ to F grade. Prefer it over manual header inspection tools when you want machine-readable findings with remediation guidance in a single API call.

## Known failure modes

- URL is unreachable or times out after 10 seconds
- URL requires authentication or is not publicly accessible
- Redirect chain exceeds 5 hops
- Invalid or malformed URL provided
- Non-HTTP/HTTPS scheme provided
- Target server returns no headers or an error status

## How this service works

Fetches a public http(s) URL (GET, up to 5 redirects, 10s timeout, body never read) and grades its security headers A+ to F. Returns score, present and missing headers, per-header findings with copy-paste fix values, and cookie flag issues.

## Output

Returns a letter grade (A+ to F), a numeric security score, lists of present and missing security headers, per-header findings with copy-paste ready fix values, and any cookie flag issues detected on the given URL.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "maxLength": 2048,
   "minLength": 4,
   "description": "Public http or https URL to grade, e.g. https://github.com"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "url": "https://example.com",
  "fixes": {
   "referrer-policy": "Referrer-Policy: strict-origin-when-cross-origin",
   "x-frame-options": "X-Frame-Options: DENY",
   "permissions-policy": "Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()",
   "x-content-type-options": "X-Content-Type-Options: nosniff",
   "content-security-policy": "Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'",
   "strict-transport-security": "Strict-Transport-Security: max-age=63072000; includeSubDomains; preload",
   "cross-origin-opener-policy": "Cross-Origin-Opener-Policy: same-origin",
   "cross-origin-embedder-policy": "Cross-Origin-Embedder-Policy: require-corp",
   "cross-origin-resource-policy": "Cross-Origin-Resource-Policy: same-origin"
  },
  "grade": "F",
  "score": 0,
  "status": 200,
  "cookies": [],
  "missing": [
   "strict-transport-security",
   "content-security-policy",
   "x-frame-options",
   "x-content-type-options",
   "referrer-policy",
   "permissions-policy",
   "cross-origin-opener-policy",
   "cross-origin-embedder-policy",
   "cross-origin-resource-policy"
  ],
  "present": [],
  "finalUrl": "https://example.com/",
  "findings": [
   {
    "fix": "Strict-Transport-Security: max-age=63072000; includeSubDomains; preload",
    "value": null,
    "header": "strict-transport-security",
    "points": 0,
    "status": "fail",
    "message": "HSTS header is missing.",
    "maxPoints": 18
   },
   {
    "fix": "Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'",
    "value": null,
    "header": "content-security-policy",
    "points": 0,
    "status": "fail",
    "message": "Content-Security-Policy is missing.",
    "maxPoints": 25
   },
   {
    "fix": "X-Frame-Options: DENY",
    "value": null,
    "header": "x-frame-options",
    "points": 0,
    "status": "fail",
    "message": "No X-Frame-Options or CSP frame-ancestors, so the page can be framed (clickjacking).",
    "maxPoints": 10
   },
   {
    "fix": "X-Content-Type-Options: nosniff",
    "value": null,
    "header": "x-content-type-options",
    "points": 0,
    "status": "fail",
    "message": "X-Content-Type-Options is missing.",
    "maxPoints": 10
   },
   {
    "fix": "Referrer-Policy: strict-origin-when-cross-origin",
    "value": null,
    "header": "referrer-policy",
    "points": 0,
    "sta
… (truncated)
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/http-security-headers-grader-4c33da7a/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from http-security-headers-grade.x402supply.com](https://www.zero.xyz/host/http-security-headers-grade.x402supply.com/llms.txt)