# HubVibe Security Headers Audit

> HubVibe Security Headers Audit is a paid API for AI agents from hubvibe-io.com, paid per call via x402, $0.05/call, status unknown (last checked 2026-09-15).

Audits a live URL for HTTP security headers including HTTPS, HSTS, CSP, X-Content-Type-Options, clickjacking protection, Referrer-Policy, and CORS

## Facts

- Endpoint: POST https://hubvibe-io.com/audit/security
- Price: $0.05/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/hubvibe-security-headers-audit-325bd62c
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_jaJFzXiqQ6btSkWzVW5zb

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability hubvibe-security-headers-audit-325bd62c -d '<json body>'
```

Example prompt: Can you run a security headers audit on https://mystore.example.com and tell me if HTTPS, HSTS, CSP, clickjacking protection, Referrer-Policy, and CORS are all properly configured?

## When to prefer this

Choose this endpoint when you need a fast, live check of HTTP security response headers for a specific URL without running a full penetration test or TLS cipher analysis. It is ideal for pre-launch checks, post-deploy regression monitoring, or compliance verification where the goal is confirming standard browser-enforced security headers (HSTS, CSP, CORS, etc.) are present and correctly configured. Prefer this over full-stack security scanners when you only need header-level validation quickly and cheaply.

## Known failure modes

- URL is unreachable or returns a non-200 response — audit cannot be completed
- Target site blocks automated requests or requires authentication
- CORS or firewall rules block the auditing service from fetching headers
- Malformed or missing URL input returns a validation error
- Timeout if the target server responds too slowly

## How this service works

Security headers check for a website: audits HTTPS, HSTS, Content- Security-Policy (CSP), X-Content-Type-Options, X-Frame-Options / clickjacking protection, Referrer-Policy and CORS from the real HTTP response of any live URL. Findings with severity for what is missing. Header posture only, not a penetration test.

## Output

Returns a structured audit report of HTTP security headers from a live response to the given URL, indicating the presence, absence, or misconfiguration of HTTPS enforcement, HSTS, Content Security Policy, X-Content-Type-Options, clickjacking protection (X-Frame-Options or CSP frame-ancestors), Referrer-Policy, and CORS headers.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "format": "uri",
   "examples": [
    "https://example.com"
   ],
   "description": "Live, fetchable http(s) URL to audit."
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/hubvibe-security-headers-audit-325bd62c/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from hubvibe-io.com](https://www.zero.xyz/host/hubvibe-io.com/llms.txt)