{
  "x402Version": 2,
  "id": 53545,
  "slug": "53545",
  "resource": "https://http-security-headers-grade.x402supply.com/tools/grade_headers",
  "description": "Fetches a public http(s) URL (GET, up to 5 redirects, 10s timeout, body never read) and grades its security headers A+ to F. Returns score, present and missing headers, per-header findings with copy-paste fix values, and cookie flag issues.",
  "type": "http",
  "resourceType": "Security",
  "accepts": [
    {
      "scheme": "exact",
      "network": "eip155:8453",
      "payTo": "0x07fFB5044cF2Cd4352Be4655f578D0ba8cb754EB",
      "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
      "amount": "10000",
      "amountUsd": 0.01,
      "maxTimeoutSeconds": 60
    }
  ],
  "outputSchema": {
    "properties": {
      "example": {
        "type": "object"
      },
      "type": {
        "type": "string"
      }
    },
    "required": [
      "type"
    ],
    "type": "object"
  },
  "extensions": {
    "bazaar": {
      "info": {
        "input": {
          "body": {
            "url": "https://example.com"
          },
          "bodyType": "json",
          "method": "POST",
          "type": "http"
        },
        "output": {
          "example": {
            "cookies": [],
            "finalUrl": "https://example.com/",
            "findings": [
              {
                "fix": "Strict-Transport-Security: max-age=63072000; includeSubDomains; preload",
                "header": "strict-transport-security",
                "maxPoints": 18,
                "message": "HSTS header is missing.",
                "points": 0,
                "status": "fail",
                "value": null
              },
              {
                "fix": "Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'",
                "header": "content-security-policy",
                "maxPoints": 25,
                "message": "Content-Security-Policy is missing.",
                "points": 0,
                "status": "fail",
                "value": null
              },
              {
                "fix": "X-Frame-Options: DENY",
                "header": "x-frame-options",
                "maxPoints": 10,
                "message": "No X-Frame-Options or CSP frame-ancestors, so the page can be framed (clickjacking).",
                "points": 0,
                "status": "fail",
                "value": null
              },
              {
                "fix": "X-Content-Type-Options: nosniff",
                "header": "x-content-type-options",
                "maxPoints": 10,
                "message": "X-Content-Type-Options is missing.",
                "points": 0,
                "status": "fail",
                "value": null
              },
              {
                "fix": "Referrer-Policy: strict-origin-when-cross-origin",
                "header": "referrer-policy",
                "maxPoints": 10,
                "message": "Referrer-Policy is missing.",
                "points": 0,
                "status": "fail",
                "value": null
              },
              {
                "fix": "Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()",
                "header": "permissions-policy",
                "maxPoints": 8,
                "message": "Permissions-Policy is missing.",
                "points": 0,
                "status": "fail",
                "value": null
              },
              {
                "fix": "Cross-Origin-Opener-Policy: same-origin",
                "header": "cross-origin-opener-policy",
                "maxPoints": 5,
                "message": "Cross-Origin-Opener-Policy is missing.",
                "points": 0,
                "status": "fail",
                "value": null
              },
              {
                "fix": "Cross-Origin-Embedder-Policy: require-corp",
                "header": "cross-origin-embedder-policy",
                "maxPoints": 4,
                "message": "Cross-Origin-Embedder-Policy is missing.",
                "points": 0,
                "status": "fail",
                "value": null
              },
              {
                "fix": "Cross-Origin-Resource-Policy: same-origin",
                "header": "cross-origin-resource-policy",
                "maxPoints": 4,
                "message": "Cross-Origin-Resource-Policy is missing.",
                "points": 0,
                "status": "fail",
                "value": null
              }
            ],
            "fixes": {
              "content-security-policy": "Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'",
              "cross-origin-embedder-policy": "Cross-Origin-Embedder-Policy: require-corp",
              "cross-origin-opener-policy": "Cross-Origin-Opener-Policy: same-origin",
              "cross-origin-resource-policy": "Cross-Origin-Resource-Policy: same-origin",
              "permissions-policy": "Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()",
              "referrer-policy": "Referrer-Policy: strict-origin-when-cross-origin",
              "strict-transport-security": "Strict-Transport-Security: max-age=63072000; includeSubDomains; preload",
              "x-content-type-options": "X-Content-Type-Options: nosniff",
              "x-frame-options": "X-Frame-Options: DENY"
            },
            "grade": "F",
            "missing": [
              "strict-transport-security",
              "content-security-policy",
              "x-frame-options",
              "x-content-type-options",
              "referrer-policy",
              "permissions-policy",
              "cross-origin-opener-policy",
              "cross-origin-embedder-policy",
              "cross-origin-resource-policy"
            ],
            "present": [],
            "redirects": 0,
            "score": 0,
            "status": 200,
            "url": "https://example.com"
          },
          "type": "json"
        }
      },
      "schema": {
        "$schema": "https://json-schema.org/draft/2020-12/schema",
        "properties": {
          "input": {
            "additionalProperties": false,
            "properties": {
              "body": {
                "additionalProperties": false,
                "properties": {
                  "url": {
                    "description": "Public http or https URL to grade, e.g. https://github.com",
                    "maxLength": 2048,
                    "minLength": 4,
                    "type": "string"
                  }
                },
                "required": [
                  "url"
                ],
                "type": "object"
              },
              "bodyType": {
                "enum": [
                  "json",
                  "form-data",
                  "text"
                ],
                "type": "string"
              },
              "method": {
                "enum": [
                  "POST",
                  "PUT",
                  "PATCH"
                ],
                "type": "string"
              },
              "type": {
                "const": "http",
                "type": "string"
              }
            },
            "required": [
              "type",
              "method",
              "bodyType",
              "body"
            ],
            "type": "object"
          },
          "output": {
            "properties": {
              "example": {
                "type": "object"
              },
              "type": {
                "type": "string"
              }
            },
            "required": [
              "type"
            ],
            "type": "object"
          }
        },
        "required": [
          "input"
        ],
        "type": "object"
      }
    }
  },
  "tags": [
    "bazaar"
  ],
  "sourceHost": "http-security-headers-grade.x402supply.com",
  "lastUpdated": "2026-10-09T18:11:46.132Z",
  "quality": {
    "calls30d": 1,
    "uniquePayers30d": 1,
    "lastCalledAt": "2026-10-09T18:11:45.668Z"
  },
  "metadata": {
    "extensions": {
      "bazaar": {
        "info": {
          "input": {
            "body": {
              "url": "https://example.com"
            },
            "bodyType": "json",
            "method": "POST",
            "type": "http"
          },
          "output": {
            "example": {
              "cookies": [],
              "finalUrl": "https://example.com/",
              "findings": [
                {
                  "fix": "Strict-Transport-Security: max-age=63072000; includeSubDomains; preload",
                  "header": "strict-transport-security",
                  "maxPoints": 18,
                  "message": "HSTS header is missing.",
                  "points": 0,
                  "status": "fail",
                  "value": null
                },
                {
                  "fix": "Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'",
                  "header": "content-security-policy",
                  "maxPoints": 25,
                  "message": "Content-Security-Policy is missing.",
                  "points": 0,
                  "status": "fail",
                  "value": null
                },
                {
                  "fix": "X-Frame-Options: DENY",
                  "header": "x-frame-options",
                  "maxPoints": 10,
                  "message": "No X-Frame-Options or CSP frame-ancestors, so the page can be framed (clickjacking).",
                  "points": 0,
                  "status": "fail",
                  "value": null
                },
                {
                  "fix": "X-Content-Type-Options: nosniff",
                  "header": "x-content-type-options",
                  "maxPoints": 10,
                  "message": "X-Content-Type-Options is missing.",
                  "points": 0,
                  "status": "fail",
                  "value": null
                },
                {
                  "fix": "Referrer-Policy: strict-origin-when-cross-origin",
                  "header": "referrer-policy",
                  "maxPoints": 10,
                  "message": "Referrer-Policy is missing.",
                  "points": 0,
                  "status": "fail",
                  "value": null
                },
                {
                  "fix": "Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()",
                  "header": "permissions-policy",
                  "maxPoints": 8,
                  "message": "Permissions-Policy is missing.",
                  "points": 0,
                  "status": "fail",
                  "value": null
                },
                {
                  "fix": "Cross-Origin-Opener-Policy: same-origin",
                  "header": "cross-origin-opener-policy",
                  "maxPoints": 5,
                  "message": "Cross-Origin-Opener-Policy is missing.",
                  "points": 0,
                  "status": "fail",
                  "value": null
                },
                {
                  "fix": "Cross-Origin-Embedder-Policy: require-corp",
                  "header": "cross-origin-embedder-policy",
                  "maxPoints": 4,
                  "message": "Cross-Origin-Embedder-Policy is missing.",
                  "points": 0,
                  "status": "fail",
                  "value": null
                },
                {
                  "fix": "Cross-Origin-Resource-Policy: same-origin",
                  "header": "cross-origin-resource-policy",
                  "maxPoints": 4,
                  "message": "Cross-Origin-Resource-Policy is missing.",
                  "points": 0,
                  "status": "fail",
                  "value": null
                }
              ],
              "fixes": {
                "content-security-policy": "Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'",
                "cross-origin-embedder-policy": "Cross-Origin-Embedder-Policy: require-corp",
                "cross-origin-opener-policy": "Cross-Origin-Opener-Policy: same-origin",
                "cross-origin-resource-policy": "Cross-Origin-Resource-Policy: same-origin",
                "permissions-policy": "Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()",
                "referrer-policy": "Referrer-Policy: strict-origin-when-cross-origin",
                "strict-transport-security": "Strict-Transport-Security: max-age=63072000; includeSubDomains; preload",
                "x-content-type-options": "X-Content-Type-Options: nosniff",
                "x-frame-options": "X-Frame-Options: DENY"
              },
              "grade": "F",
              "missing": [
                "strict-transport-security",
                "content-security-policy",
                "x-frame-options",
                "x-content-type-options",
                "referrer-policy",
                "permissions-policy",
                "cross-origin-opener-policy",
                "cross-origin-embedder-policy",
                "cross-origin-resource-policy"
              ],
              "present": [],
              "redirects": 0,
              "score": 0,
              "status": 200,
              "url": "https://example.com"
            },
            "type": "json"
          }
        },
        "schema": {
          "$schema": "https://json-schema.org/draft/2020-12/schema",
          "properties": {
            "input": {
              "additionalProperties": false,
              "properties": {
                "body": {
                  "additionalProperties": false,
                  "properties": {
                    "url": {
                      "description": "Public http or https URL to grade, e.g. https://github.com",
                      "maxLength": 2048,
                      "minLength": 4,
                      "type": "string"
                    }
                  },
                  "required": [
                    "url"
                  ],
                  "type": "object"
                },
                "bodyType": {
                  "enum": [
                    "json",
                    "form-data",
                    "text"
                  ],
                  "type": "string"
                },
                "method": {
                  "enum": [
                    "POST",
                    "PUT",
                    "PATCH"
                  ],
                  "type": "string"
                },
                "type": {
                  "const": "http",
                  "type": "string"
                }
              },
              "required": [
                "type",
                "method",
                "bodyType",
                "body"
              ],
              "type": "object"
            },
            "output": {
              "properties": {
                "example": {
                  "type": "object"
                },
                "type": {
                  "type": "string"
                }
              },
              "required": [
                "type"
              ],
              "type": "object"
            }
          },
          "required": [
            "input"
          ],
          "type": "object"
        }
      }
    }
  },
  "liveness": {
    "reliability": null
  },
  "verified": false,
  "featured": false,
  "provider": {
    "host": "http-security-headers-grade.x402supply.com",
    "manifest_name": "http-security-headers-grade.x402supply.com",
    "source": "cdp-mirror",
    "source_manifest_url": "https://api.cdp.coinbase.com/platform/v2/x402/discovery/resources",
    "submitted_at": "2026-10-14T01:15:01.050Z"
  },
  "exampleResponse": {
    "example": {},
    "type": "string"
  }
}