Audit a page's HTTP security headers

$0.003 per call · failed calls are never charged · no account or API key needed

Fetch a public URL and grade its HTTP security headers: HSTS, Content-Security-Policy, framing protection, nosniff, Referrer-Policy and Permissions-Policy, plus version leaks (Server, X-Powered-By) and cookies missing Secure, HttpOnly or SameSite. Returns a grade A-F, a score and each check with its value. Use to review a site's basic web security; for DNS and email records use domain. Private hosts are refused with 400, uncharged.

Run it free (25 free calls) Buy credits by card (from $5) Example result (JSON)

Inputs

NameTypeDescription
url (required)stringPublic http(s) URL to check

Request

Over HTTP, with a card key from /credits:

curl -H "Authorization: Bearer adt_…" "https://agent-data-tools.revmesh2074.workers.dev/http/security-headers?url=https%3A%2F%2Fexample.com"

Or one of your 25 free calls, no key:

curl "https://agent-data-tools.revmesh2074.workers.dev/http/security-headers?url=https%3A%2F%2Fexample.com&trial=1"

Without a key, the same URL answers 402 Payment Required with x402 and MPP terms, so an agent with a wallet pays per call in USDC (Base, Polygon, Arbitrum, Monad, World Chain or Tempo) and retries.

Example result

{
  "url": "https://example.com",
  "finalUrl": "https://example.com/",
  "status": 200,
  "grade": "C",
  "score": 60,
  "checks": [
    {
      "header": "strict-transport-security",
      "status": "fail",
      "value": null,
      "note": "missing: browsers may load the site over plain HTTP"
    }
  ]
}

From an AI agent (MCP)

Add the MCP server to Claude, Cursor or any MCP client. This tool is http_security_headers, and the first 25 successful calls are free:

https://agent-data-tools.revmesh2074.workers.dev/mcp

Related tools