# Lookproof HTTP Security Headers Checker

> Lookproof HTTP Security Headers Checker is a paid API for AI agents from api.lookproof.dev, paid per call via x402, $0.01/call, status unknown (last checked 2026-10-31).

Follows a domain's HTTP-to-HTTPS redirect chain and inspects the security headers of the final HTTPS response, including HSTS, CSP, X-Content-Type-Options, framing, Referrer-Policy, and cookie flags.

## Facts

- Endpoint: GET https://api.lookproof.dev/v1/http/security-headers?utm_source=zero.xyz
- Price: $0.01/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-31
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/lookproof-http-security-headers-checker-6d39f5bb
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_C5b2GTFBua_QFSFcLq4iy

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability lookproof-http-security-headers-checker-6d39f5bb
```

Example prompt: Can you check the HTTP security headers for example.com — specifically whether it enforces HTTPS, if it's HSTS preload ready, and whether any key headers like CSP or X-Content-Type-Options are missing?

## When to prefer this

Choose this endpoint when you need to audit a specific domain's HTTPS enforcement and HTTP security header posture — particularly when you need HSTS preload readiness analysis, CSP unsafe-inline detection, or a complete view of which security headers are present or absent. It is distinct from TLS certificate checkers (which inspect the cert itself), DNS security auditors, and general HTTP response inspectors. Use it for pre-launch security reviews, HSTS preload submission troubleshooting, compliance checks, or ongoing security monitoring of web properties.

## Known failure modes

- Domain does not resolve — DNS lookup failure returned
- Site does not respond to HTTP or HTTPS — connection timeout
- Domain redirects to a non-HTTPS final URL — HTTPS enforcement failure noted
- Invalid domain format supplied — input validation error
- Rate limiting or upstream block prevents header fetch — error response returned
- Final destination returns non-standard or missing headers — gaps explicitly noted in output

## How this service works

Check SPF, DMARC, DKIM, MTA-STS, DNSSEC and more, with results that explain what was found and why. Free browser checks and a pay-per-request API with x402.

## Output

Returns the full redirect chain from HTTP and HTTPS origins to the final HTTPS destination, along with parsed security header findings: HSTS presence, max-age, includeSubDomains, preload flag and preload readiness assessment; CSP presence and unsafe-inline detection; X-Content-Type-Options value; frame protection (X-Frame-Options or CSP frame-ancestors); Referrer-Policy value; and cookie security flags (Secure, HttpOnly, SameSite — flags only, not values). Missing headers are explicitly flagged.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET",
      "HEAD",
      "DELETE"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "title": "DomainInput",
     "required": [
      "domain"
     ],
     "properties": {
      "domain": {
       "type": "string",
       "title": "Domain",
       "examples": [
        "example.com"
       ],
       "maxLength": 1024,
       "minLength": 1
      }
     },
     "additionalProperties": false
    }
   },
   "additionalProperties": false
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/lookproof-http-security-headers-checker-6d39f5bb/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.lookproof.dev](https://www.zero.xyz/host/api.lookproof.dev/llms.txt)