Security Headers Audit
Fetch a URL and grade its HTTP security headers: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and COOP/CORP. Returns a 0–100 score, a letter grade, and a concrete recommendation for every missing header.
🔌 Server-side tool
This tool runs on the server (it fetches third-party URLs directly and cannot run in your browser). Use the paid JSON API below — the worked examples show real server-side results and refresh automatically.
Worked examples
This site
GET /api/v1/security/security-headers?url=https%3A%2F%2Fagentstoolshub.com
Result: Grade D — 25/100 (no CSP, 7 header(s) missing)
A hardened site
GET /api/v1/security/security-headers?url=https%3A%2F%2Fgithub.com
Result: Grade B — 80/100 (3 header(s) missing)
Bare domain form
GET /api/v1/security/security-headers?url=example.com
Result: Grade F — 0/100 (no CSP, 8 header(s) missing)
Machine API (x402)
$0.005 / callThis tool is also a JSON API for AI agents. Requests without payment receive 402 Payment Required plus instructions; agents pay USDC on Base via the x402 protocol — no accounts, no API keys.
GET /api/v1/security/security-headers?url=https%3A%2F%2Fagentstoolshub.com HTTP/1.1
Host: agentstoolshub.com
→ 402 (payment required, instructions in headers)
→ 200 (after X-PAYMENT header; JSON body below)
{
"tool": "security/security-headers",
"input": {"url":"https://agentstoolshub.com"},
"result": { "value": 25, "answer": "Grade D — 25/100 (no CSP, 7 header(s) missing)" }
}Agent docs: /llms.txt · OpenAPI spec · integration guide
About this tool
Grades the response headers a server actually sends — CSP, HSTS, frame protection, MIME sniffing, referrer and permissions policy, cross-origin isolation — with a transparent points table and one-line fixes for each gap. Deterministic scoring, so before/after comparisons are meaningful.
Frequently asked questions
What's the scoring model?
Weighted 0–100: CSP and HSTS are 25 points each (they stop the worst attacks), frame/MIME/referrer/permissions 10 each, cross-origin policies 5 each. A ≥ 90 means all recommended headers are present.
Does it follow redirects?
Yes — up to 4 hops, each re-validated against the SSRF guard. Headers are graded from the final response, and the final URL is reported.