# Tanod Web HTTP Security Headers Grader

> Tanod Web HTTP Security Headers Grader is a paid API for AI agents from web.tanod.dev, paid per call via x402, $0.002/call, status unknown (last checked 2026-10-13).

Fetches and analyzes the HTTP response headers of a given URL, grading its security posture across CSP, HSTS, cookies, framing protections, and more.

## Facts

- Endpoint: POST https://web.tanod.dev/v1/headers?utm_source=zero.xyz
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-13
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/tanod-web-http-security-headers-grader-d1f65974
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_M0XiGCIX9o_M3i-rzGFt-

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability tanod-web-http-security-headers-grader-d1f65974 -d '<json body>'
```

Example prompt: Can you check the security headers for https://example.com and tell me the overall grade, whether HSTS and CSP are configured properly, and what deductions are bringing the score down?

## When to prefer this

Choose this endpoint when you need a detailed, scored breakdown of HTTP security headers for a specific URL — including CSP, HSTS, cookies, and framing policies — rather than just fetching raw headers. It is ideal for security audits, pre-launch checklists, developer hardening reviews, and benchmarking sites against best practices. Prefer this over generic HTTP inspection tools when you need an actionable grade with specific deductions and explanations.

## Known failure modes

- Non-public or unreachable URLs return an error (e.g. localhost, private IPs)
- URLs exceeding 2048 characters are rejected
- Sites with connection timeouts or SSL errors may fail to return headers
- Some servers return minimal headers, resulting in many deductions but a valid response
- Only the final response headers are graded; other paths on the same site may differ

## How this service works

Web tools: search, page to Markdown or screenshot, company profile and jobs, sitemaps, RDAP, IP.

## Output

Returns a structured JSON object with an overall letter grade (e.g. 'A'), numeric score, HTTPS status, final URL after redirects, redirect chain, CSP analysis (directives, unsafe-eval/inline flags, missing directives), HSTS details (max-age, preload, includeSubdomains), cookie attributes (secure, HttpOnly, SameSite), X-Frame-Options, Referrer-Policy, Permissions-Policy presence, Cross-Origin policies, server disclosure headers, and a list of scored deductions explaining why points were lost.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "maxLength": 2048,
   "minLength": 1,
   "description": "Public http(s) URL whose response headers are graded (the final response after redirects)."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "csp": {
   "value": "default-src 'none'; base-uri 'self'; child-src github.githubassets.com ...",
   "present": true,
   "policies": 1,
   "directives": [
    "base-uri",
    "child-src",
    "connect-src",
    "default-src",
    "font-src",
    "form-action",
    "frame-ancestors",
    "frame-src",
    "img-src",
    "manifest-src",
    "media-src",
    "script-src",
    "style-src",
    "upgrade-insecure-requests",
    "worker-src"
   ],
   "report_only": false,
   "unsafe_eval": false,
   "unsafe_inline": false,
   "frame_ancestors": "'none'",
   "wildcard_sources": false,
   "missing_directives": [],
   "scripts_restricted": true,
   "object_src_restricted": true
  },
  "url": "https://github.com",
  "hsts": {
   "valid": true,
   "value": "max-age=31536000; includeSubdomains; preload",
   "max_age": 31536000,
   "preload": true,
   "present": true,
   "preload_eligible": true,
   "include_subdomains": true
  },
  "note": "one response's headers only; pages, APIs and error responses of the same site can differ",
  "grade": "A",
  "https": true,
  "score": 90,
  "status": 200,
  "cookies": {
   "count": 3,
   "items": [
    {
     "name": "_gh_sess",
     "secure": true,
     "httponly": true,
     "samesite": "Lax",
     "host_prefix": false,
     "secure_prefix": false
    },
    {
     "name": "_octo",
     "secure": true,
     "httponly": false,
     "samesite": "Lax",
     "host_prefix": false,
     "secure_prefix": false
    }
   ],
   "truncated": false
  },
  "final_url": "https://github.com",
  "redirects": [],
  "deductions": [
   {
    "code": "permissions_policy_missing",
    "points": 5,
    "reason": "no Permissions-Policy header"
   },
   {
    "code": "cookie_not_httponly",
    "points": 5,
    "reason": "1 cookie(s) without HttpOnly (fine only if scripts must read them)"
   }
  ],
  "disclosure": {
   "server": "github.com",
   "x_powered_by": null,
   "x_aspnet_version": null
  },
  "cross_origin": {
   "opener_policy": null,
   "embedder_policy": null,
   "resource_policy": null
  },
  "referrer_policy": {
   "note": null,
   "value": "origin-when-cross-origin, strict-origin-when-cross-origin",
   "effective": "strict-origin-when-cross-origin"
  },
  "x_frame_options": {
   "valid": true,
   "value": "DENY"
  },
  "untrusted_content": true,
  "upgraded_to_https": false,
  "permissions_policy": {
   "value": null,
   "present": false
  },
  "x_content_type_options": {
   "valid": true,
   "value": "n
… (truncated)
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/tanod-web-http-security-headers-grader-d1f65974/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from web.tanod.dev](https://www.zero.xyz/host/web.tanod.dev/llms.txt)