Security headers

Returns JSON auditing the HTTP security headers of a public URL (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, cookies) with a grade and fixes.

Use this when you need an http security headers audit of a website or URL, with a grade and what to fix.

Do not use for vulnerability scans, TLS cipher analysis or pages behind a login.

Price: 0.007 USDC per call (x402, eip155:8453). Typical response time: 2500 ms (p95).

Call it over HTTP (x402)

POST https://x402-gateway.blackwoodstate8.workers.dev/v1/http-headers. A request without payment gets 402 Payment Required with the PAYMENT-REQUIRED header; any x402 client signs an EIP-3009 authorization and retries with PAYMENT-SIGNATURE (or X-PAYMENT). Invalid input is answered with 400 and not charged.

curl -i -X POST https://x402-gateway.blackwoodstate8.workers.dev/v1/http-headers -H 'content-type: application/json' -d '{"url":"https://example.com"}'

Call it over MCP

Streamable HTTP at https://x402-gateway.blackwoodstate8.workers.dev/mcp, tool blackwood_headers_audit. Payment goes in _meta["x402/payment"]; without it the tool returns the payment requirements.

Input

Example:

{
  "url": "https://example.com"
}

Output

Real example:

{
  "url": "https://example.com",
  "finalUrl": "https://example.com/",
  "status": 200,
  "redirects": 0,
  "grade": "F",
  "score": 10,
  "checks": [
    {
      "header": "strict-transport-security",
      "result": "fail",
      "value": null,
      "advice": "Add Strict-Transport-Security: max-age=31536000; includeSubDomains"
    },
    {
      "header": "content-security-policy",
      "result": "fail",
      "value": null,
      "advice": "Add a Content-Security-Policy; start with default-src 'self' and tighten from there."
    },
    {
      "header": "x-frame-options",
      "result": "fail",
      "value": null,
      "advice": "Add X-Frame-Options: DENY (or CSP frame-ancestors 'none') against clickjacking."
    },
    {
      "header": "x-content-type-options",
      "result": "fail",
      "value": null,
      "advice": "Add X-Content-Type-Options: nosniff."
    },
    {
      "header": "referrer-policy",
      "result": "warn",
      "value": null,
      "advice": "Add Referrer-Policy: strict-origin-when-cross-origin."
    },
    {
      "header": "permissions-policy",
      "result": "warn",
      "value": null,
      "advice": "Add a Permissions-Policy that turns off features you do not use (camera, microphone, geolocation)."
    }
  ],
  "cookies": [],
  "checkedAt": "2026-10-17T16:49:19.296Z"
}

{
  "type": "object",
  "properties": {
    "url": {
      "type": "string"
    },
    "finalUrl": {
      "type": "string"
    },
    "status": {
      "type": "number"
    },
    "redirects": {
      "type": "number"
    },
    "grade": {
      "type": "string"
    },
    "score": {
      "type": "number"
    },
    "checks": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "header": {
            "type": "string"
          },
          "result": {
            "type": "string",
            "enum": [
              "pass",
              "warn",
              "fail",
              "info"
            ]
          },
          "value": {
            "type": [
              "string",
              "null"
            ]
          },
          "advice": {
            "type": "string"
          }
        },
        "required": [
          "header",
          "result",
          "value",
          "advice"
        ],
        "additionalProperties": false
      }
    },
    "cookies": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "name": {
            "type": "string"
          },
          "secure": {
            "type": "boolean"
          },
          "httpOnly": {
            "type": "boolean"
          },
          "sameSite": {
            "type": [
              "string",
              "null"
            ]
          }
        },
        "required": [
          "name",
          "secure",
          "httpOnly",
          "sameSite"
        ],
        "additionalProperties": false
      }
    },
    "checkedAt": {
      "type": "string"
    }
  },
  "required": [
    "url",
    "finalUrl",
    "status",
    "redirects",
    "grade",
    "score",
    "checks",
    "cookies",
    "checkedAt"
  ],
  "additionalProperties": false
}

More

Free schema and example: GET https://x402-gateway.blackwoodstate8.workers.dev/v1/http-headers. OpenAPI 3.1 · llms.txt · All services