Overview
Fetches a URL and evaluates 10 security-critical response headers (CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, CORP, COEP, COOP), detects anti-patterns, and returns an overall security grade (A–F).
Protocol
x402
Price
$0.01
Payment Asset
USDC
Payment Network
base
Category
tools/security
Provider
NetIntel
Source
bazaar
Indexed
2026-06-21 04:15:48
Health
Status
healthy
Latency (p50)
513ms
Uptime (30d)
100.0%
Reliability Score
90/100
Last Checked
2026-10-31 07:03:28
Last Healthy
2026-10-31 07:03:28
Consecutive Failures
0
x402 Payment Validation
Payment Requirements
Valid
Asset Verified
Known USDC
Facilitator
—
Input Schema
{
"method": "GET",
"queryParams": {
"target": "https://example.com"
},
"type": "http"
}
Output Schema
{
"example": {
"deductions": [
{
"points": -5,
"reason": "Permissions-Policy not set"
},
{
"points": -2,
"reason": "Cross-Origin-Resource-Policy not set"
},
{
"points": -2,
"reason": "Cross-Origin-Embedder-Policy not set"
},
{
"points": -2,
"reason": "Cross-Origin-Opener-Policy not set"
},
{
"points": -3,
"reason": "X-Powered-By header exposes server framework"
}
],
"errors": [],
"grade": "B",
"meta": {
"duration_ms": 312
},
"results": {
"anti_patterns": [
{
"header": "x-powered-by",
"raw_value": "Express",
"reason": "Information leakage — reveals server framework",
"severity": "warn"
}
],
"content_type": "text/html; charset=utf-8",
"final_url": "https://example.com/",
"headers": {
"content-security-policy": {
"present": true,
"raw_value": "default-src 'self'",
"reason": "Content-Security-Policy is set with a strong policy",
"status": "pass"
},
"cross-origin-embedder-policy": {
"present": false,
"raw_value": null,
"reason": "Cross-Origin-Embedder-Policy not set",
"status": "info"
},
"cross-origin-opener-policy": {
"present": false,
"raw_value": null,
"reason": "Cross-Origin-Opener-Policy not set",
"status": "info"
},
"cross-origin-resource-policy": {
"present": false,
"raw_value": null,
"reason": "Cross-Origin-Resource-Policy not set",
"status": "info"
},
"permissions-policy": {
"present": false,
"raw_value": null,
"reason": "Permissions-Policy not set — browser features not restricted",
"status": "warn"
},
"referrer-policy": {
"present": true,
"raw_value": "strict-origin-when-cross-origin",
"reason": "Referrer-Policy is set to strict-origin-when-cross-origin",
"status": "pass"
},
"strict-transport-security": {
"present": true,
"raw_value": "max-age=31536000; includeSubDomains",
"reason": "HSTS enabled with max-age=31536000",
"status": "pass"
},
"x-content-type-options": {
"present": true,
"raw_value": "nosniff",
"reason": "X-Content-Type-Options is set to nosniff",
"status": "pass"
},
"x-frame-options": {
"present": true,
"raw_value": "DENY",
"reason": "X-Frame-Options is set to DENY",
"status": "pass"
},
"x-xss-protection": {
"present": false,
"raw_value": null,
"reason": "X-XSS-Protection not set — modern browsers use CSP instead",
"status": "info"
}
},
"status_code": 200,
"summary": {
"fail": 0,
"info": 4,
"pass": 6,
"warn": 0
}
},
"score": 78,
"service": "security-headers",
"target": "https://example.com",
"timestamp": "2025-01-15T12:00:00.000Z",
"warnings": []
},
"type": "json"
}