# Vextorium Security Headers Audit

> Vextorium Security Headers Audit is a paid API for AI agents from api.vextorium.com, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-19).

Audits a website's HTTP security headers (HTTPS, HSTS, CSP, X-Frame-Options, etc.) and returns a scored report of present and missing headers with explanations.

## Facts

- Endpoint: POST https://api.vextorium.com/v1/security-headers?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-19
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/vextorium-security-headers-audit-12da80f5
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_10iGayShbY_cs3S4TXrKK

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability vextorium-security-headers-audit-12da80f5 -d '<json body>'
```

Example prompt: Can you audit the security headers on https://mycompany.com and tell me which ones are missing, which are present, and what score it gets?

## When to prefer this

Use this endpoint when you need a quick, automated audit of a website's HTTP security header configuration — especially useful for pre-launch checks, vendor assessments, or compliance reviews. It covers the standard set of seven security headers plus cookie flags in a single call, returning actionable details about what is missing and why it matters. Prefer this over manual curl-based checks or full penetration testing tools when you want a fast, programmatic, scored summary without authentication or browser rendering.

## Known failure modes

- Unreachable or invalid URL returns an error or incomplete data
- Sites behind WAFs or Cloudflare bot protection may block the audit request
- Redirect chains may cause the final URL to differ from the input
- Score may be low for legitimate single-page apps that intentionally omit some headers
- Non-HTTPS URLs may return limited results if the site redirects to HTTPS

## How this service works

232 pay-per-call data APIs for AI agents: official statistics and economy (ECB, Fed, Eurostat, World Bank, SEC, BOE, INE), crypto prices and sentiment, Spanish public data, compliance (sanctions, VAT, IBAN, LEI), science, weather, web and developer tools and local AI text tools. Pay in USDC via x402.

## Output

Returns a JSON object with: a score (e.g. '1/7'), whether the site uses HTTPS, the final resolved URL, HTTP status code, server identifier, a list of present headers (as key-value pairs), a list of missing headers with explanations of what each one does, cookie security flags, and a note that this is a passive header review rather than a full security audit.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "url": {
   "type": "string",
   "description": "Website URL or domain"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "note": "Passive header review; not a full security audit.",
  "score": "1/7",
  "server": "cloudflare",
  "cookies": [],
  "url_final": "https://example.com/",
  "uses_https": true,
  "status_code": 200,
  "missing_headers": [
   {
    "header": "strict-transport-security",
    "what_it_is_for": "HSTS: forces HTTPS"
   }
  ],
  "present_headers": {}
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/vextorium-security-headers-audit-12da80f5/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from api.vextorium.com](https://www.zero.xyz/host/api.vextorium.com/llms.txt)