# Tinstop HTTP Security Headers Check

> Tinstop HTTP Security Headers Check is a paid API for AI agents from tinstop.com, paid per call via x402, $0.02/call, status unknown (last checked 2026-09-15).

Audits a domain's HTTP security headers, grades them A–F, and returns missing headers with remediation recommendations.

## Facts

- Endpoint: POST https://tinstop.com/v1/headers-check
- Price: $0.02/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/tinstop-http-security-headers-check-3e2f40ed
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_-M457c1H793cNhXACtHcQ

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability tinstop-http-security-headers-check-3e2f40ed -d '<json body>'
```

Example prompt: Can you audit the HTTP security headers for stripe.com and tell me what grade it gets, which headers are missing, and what I should fix?

## When to prefer this

Choose this endpoint when you need a focused, structured audit of HTTP security response headers specifically — including Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, and similar — with an actionable letter grade and remediation advice. It is the right choice over generic DNS or SSL checks when the goal is hardening web application HTTP response security. It is distinct from the email authentication (SPF/DKIM/DMARC) and DNS sibling endpoints on the same platform.

## Known failure modes

- Domain unreachable or does not exist — may return error or low-grade result with empty headers
- Domain provided with http:// or https:// prefix — schema requires bare domain without protocol
- Rate limiting or upstream connectivity issues may delay or fail the scan
- Domain resolves but returns unexpected HTTP status codes causing incomplete header analysis

## How this service works

Tinstop is a machine-payable Website Intelligence API for domain security and performance audits: DNS, SSL/TLS, HTTP security headers, SPF/DKIM/DMARC email authentication, and Google PageSpeed. Pay per call with x402 using USDC on Base. No accounts or API keys.

## Output

Returns a JSON object containing the domain, HTTP status code, a full map of present response headers, an array of missing recommended security headers, an A–F security grade, a list of specific issues found, detailed recommendations for fixing each missing header, a unique scan ID, and a flag indicating whether the result was cached.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "domain": {
   "type": "string",
   "description": "The domain name to check (e.g. 'example.com'). Do not include http:// or https:// protocol prefixes."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "object",
 "title": "HeadersCheckResponse",
 "required": [
  "domain",
  "http_status",
  "headers",
  "missing_headers",
  "grade",
  "recommendations",
  "issues",
  "scan_id"
 ],
 "properties": {
  "grade": {
   "type": "string",
   "title": "Grade",
   "description": "Security score grade (A/B/C/D/F) based on recommended headers"
  },
  "cached": {
   "type": "boolean",
   "title": "Cached",
   "default": false
  },
  "domain": {
   "type": "string",
   "title": "Domain"
  },
  "issues": {
   "type": "array",
   "items": {
    "type": "object",
    "additionalProperties": true
   },
   "title": "Issues"
  },
  "headers": {
   "type": "object",
   "title": "Headers",
   "additionalProperties": {
    "anyOf": [
     {
      "type": "string"
     },
     {
      "type": "null"
     }
    ]
   }
  },
  "scan_id": {
   "type": "string",
   "title": "Scan Id"
  },
  "request_id": {
   "anyOf": [
    {
     "type": "string"
    },
    {
     "type": "null"
    }
   ],
   "title": "Request Id",
   "description": "Gateway request tracking ID"
  },
  "http_status": {
   "type": "integer",
   "title": "Http Status"
  },
  "missing_headers": {
   "type": "array",
   "items": {
    "type": "string"
   },
   "title": "Missing Headers"
  },
  "recommendations": {
   "type": "array",
   "items": {
    "type": "string"
   },
   "title": "Recommendations",
   "description": "Detailed configuration improvements for missing headers"
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/tinstop-http-security-headers-check-3e2f40ed/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from tinstop.com](https://www.zero.xyz/host/tinstop.com/llms.txt)