Browse indexable security x402 offerings, including provider, method, and service details.
4139 indexable offerings in this category.
Does https://<domain>/.well-known/apple-app-site-association exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. Presence of .well-known/apple-app-site-association tells you about the site's tooling and policies. $0.01 per check.
Does https://<domain>/.well-known/assetlinks.json exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. Presence of .well-known/assetlinks.json tells you about the site's tooling and policies. $0.01 per check.
Does https://<domain>/.well-known/brave-rewards-verification.txt exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. Presence of .well-known/brave-rewards-verification.txt tells you about the site's tooling and policies. $0.01 per check.
Does https://<domain>/.well-known/change-password exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. Presence of .well-known/change-password tells you about the site's tooling and policies. $0.01 per check.
Does https://<domain>/.well-known/did.json exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. Presence of .well-known/did.json tells you about the site's tooling and policies. $0.01 per check.
Does https://<domain>/.well-known/dnt-policy.txt exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. Presence of .well-known/dnt-policy.txt tells you about the site's tooling and policies. $0.01 per check.
Does https://<domain>/.well-known/gpc.json exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. Presence of .well-known/gpc.json tells you about the site's tooling and policies. $0.01 per check.
Does https://<domain>/.well-known/host-meta exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. Presence of .well-known/host-meta tells you about the site's tooling and policies. $0.01 per check.
Does https://<domain>/.well-known/jwks.json exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. Presence of .well-known/jwks.json tells you about the site's tooling and policies. $0.01 per check.
Does https://<domain>/.well-known/oauth-protected-resource exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. Presence of .well-known/oauth-protected-resource tells you about the site's tooling and policies. $0.01 per check.
Does https://<domain>/.well-known/openid-configuration exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. Presence of .well-known/openid-configuration tells you about the site's tooling and policies. $0.01 per check.
Does https://<domain>/.well-known/openpgpkey/policy exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. Presence of .well-known/openpgpkey/policy tells you about the site's tooling and policies. $0.01 per check.
Does https://<domain>/.well-known/security.txt exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. Presence of .well-known/security.txt tells you about the site's tooling and policies. $0.01 per check.
Change watch for site has well known security txt: runs the check, compares it with the result from your previous call for the same domain (kept 90 days) and returns the current answer, changed true/false, the fields that changed with before/after values, and when it was last seen. Schedule it to be alerted when this changes. $0.02 per check.
Does https://<domain>/.well-known/tdmrep.json exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. Presence of .well-known/tdmrep.json tells you about the site's tooling and policies. $0.01 per check.
Does https://<domain>/.well-known/traffic-advice exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. Presence of .well-known/traffic-advice tells you about the site's tooling and policies. $0.01 per check.
Does https://<domain>/.well-known/trust.txt exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. Presence of .well-known/trust.txt tells you about the site's tooling and policies. $0.01 per check.
Does https://<domain>/.well-known/x402 exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. Presence of .well-known/x402 tells you about the site's tooling and policies. $0.01 per check.
Does https://<domain>/wp-login.php exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. An exposed wp-login.php is a security finding. $0.01 per check.
Change watch for site has wp login php: runs the check, compares it with the result from your previous call for the same domain (kept 90 days) and returns the current answer, changed true/false, the fields that changed with before/after values, and when it was last seen. Schedule it to be alerted when this changes. $0.02 per check.
Does https://<domain>/xmlrpc.php exist? Requests the path and returns the HTTP status, content type, size and the first 300 characters when it is text. An exposed xmlrpc.php is a security finding. $0.01 per check.
The x-permitted-cross-domain-policies response header of a URL: whether it is present, its value, and a one-line reading of what the value means (or the risk of its absence for security headers). One header, one answer, for audits and monitoring scripts. $0.01 per check.
Subdomains of a domain seen in certificate transparency logs: each name with the first and last certificate dates, the issuer of the newest certificate, and wildcard entries flagged. Deduplicated, newest first, up to 500. CertSpotter is read first, but its free index is partial, so those answers are marked truncated with the reason; crt.sh is the fallback and is complete. Only public certificates are listed.
Website audit in one call: WCAG 2.2 accessibility issues (European Accessibility Act) with fixes and a score, SEO basics, security headers and tech stack.