Browse indexable security x402 offerings, including provider, method, and service details.
4139 indexable offerings in this category.
SSL/TLS certificate analysis — issuer, SAN list, serial number, validity period, days until expiry. TLS 1.0/1.1/1.2/1.3 individual probing. Automated A-F security grade. No SSL library setup or certificate parsing needed. Accepts USDC payments on Base and Solana
Security header audit — 10 headers checked: CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, CORP, COEP, COOP. Information leakage detection via Server/X-Powered-By headers. A-F security grade. Accepts USDC payments on Base and Solana
Redirect chain analysis — follows up to 10 hops (301/302/303/307/308) with per-hop timing, status codes, TLS status. Detects HTTPS-to-HTTP TLS downgrade, redirect loops, excessive chains. A-F grade. SSRF-safe. Accepts USDC payments on Base and Solana
Subdomain discovery via certificate database — finds all subdomains with issued SSL certificates. Discovers API endpoints, staging servers, mail servers, and forgotten infrastructure. Deduplication and wildcard handling included. Accepts USDC payments on Base and Solana
Complete domain intelligence in one call — WHOIS, multi-resolver DNS, SSL/TLS, tech stack, security headers, subdomain discovery, redirect chain. All 7 run in parallel with individual timeouts. Partial results on component failure. Weighted overall security grade. Doing this yourself requires 7 separate tools and result aggregation. Accepts USDC payments on Base and Solana
Use for attack-surface mapping, asset inventory or competitive research: lists every hostname under a domain that appears in unexpired publicly-logged TLS certificates, deduplicated, with wildcard flag, first-seen date, latest certificate expiry and issuer. Data from crt.sh (Sectigo) with Cert Spotter (SSLMate) as fallback; the response names the source. Only names in public certificates, no DNS brute force.
Use when you need to check whether a domain is protected against email spoofing or set up for deliverability: reads MX (and guesses the mail provider), SPF (qualifier, lookup count), DMARC (policy, pct, report addresses), DKIM on common selectors, MTA-STS (record and policy mode), TLS-RPT and BIMI, and returns a grade A-F, a score and a list of concrete issues.
Use when you need to know whether a website or mail server has a valid HTTPS certificate or when it expires: opens a live TLS connection (SNI) to the host and returns whether the chain is publicly trusted (with the exact error, e.g. CERT_HAS_EXPIRED or self-signed), whether the certificate matches the hostname, validity dates and days remaining, subject, issuer, SAN list, key type, TLS protocol, cipher, ALPN and the certificate chain. Answers about the certificate even when it is invalid (that is the point); unreachable hosts are not charged. Hosts served by Cloudflare's own network cannot be probed live from our Workers; for those the response has live:false and shows the newest unexpired certificate logged for the host in Certificate Transparency (trusted:null).
Use when you need to check whether a domain is protected against email spoofing or set up for deliverability: reads MX (and guesses the mail provider), SPF (qualifier, lookup count), DMARC (policy, pct, report addresses), DKIM on common selectors, MTA-STS (record and policy mode), TLS-RPT and BIMI, and returns a grade A-F, a score and a list of concrete issues.
Use when you need to know whether a website or mail server has a valid HTTPS certificate or when it expires: opens a live TLS connection (SNI) to the host and returns whether the chain is publicly trusted (with the exact error, e.g. CERT_HAS_EXPIRED or self-signed), whether the certificate matches the hostname, validity dates and days remaining, subject, issuer, SAN list, key type, TLS protocol, cipher, ALPN and the certificate chain. Answers about the certificate even when it is invalid (that is the point); unreachable hosts are not charged. Hosts served by Cloudflare's own network cannot be probed live from our Workers; for those the response has live:false and shows the newest unexpired certificate logged for the host in Certificate Transparency (trusted:null).
Use for attack-surface mapping, asset inventory or competitive research: lists every hostname under a domain that appears in unexpired publicly-logged TLS certificates, deduplicated, with wildcard flag, first-seen date, latest certificate expiry and issuer. Data from crt.sh (Sectigo) with Cert Spotter (SSLMate) as fallback; the response names the source. Only names in public certificates, no DNS brute force.
Tip/entry ($0.01): tip receipt (brand+date+content hash, no payTo) PLUS one Signal archive day unlock. Body { date: YYYY-MM-DD }. First-penny path into Signal archive — primary CTA remains signal_latest $0.03.
Domain Intel ($0.012): domain identity & trust posture in one call — RDAP registration data (registrar, creation/expiration/last-changed dates, status, nameservers, or a clean not-registered result),…
Supporting meta: public-origin rotation chain for THIS brand. Secondary to Signal.
Has a ransomware group claimed this company or vendor? Input: ?q=acme.com or ?q=Acme Corp (domain or company name). Returns found, claim_count and each claim's group, claimed/first-seen dates, country, sector and source with license. $0.01 USDC on Base. Useful for vendor due diligence. These are unverified claims from criminal leak sites, not proof of a breach. For many domains at once use /v1/batch ($0.05).
Computes a SHA-256, SHA-512, or MD5 hash digest of provided text.
Decodes a JWT's header and payload for inspection. Does NOT verify the signature — for debugging/inspection only, never trust the output as authenticated.
Generates a cryptographically random password or token of a given length.
Computes a SHA-256, SHA-512, or MD5 hash digest of provided text.
Decodes a JWT's header and payload for inspection. Does NOT verify the signature — for debugging/inspection only, never trust the output as authenticated.
Generates a cryptographically random password or token of a given length.
Research a company or website in one call: what they do, legitimacy verdict, domain age, how to reach them, social presence, scam red flags — background checks for agents. Sources disclosed, not a black box: RDAP registry domain age, HTTPS reachability, on-page contact signals, DYOE human-vouch registry. Input: ?target=domain
Issue a signed, independently verifiable credential that a business domain passed a trust check — returns verdict, trust_score and domain_age. Input: ?domain=
Vet an entire payment before an agent sends money: is the counterparty site legit, is the payee wallet sanctioned or disposable, is the amount within policy. Returns proceed/caution/stop, reasons, and a signed attestation — one go/no-go instead of three calls. Input: ?domain=merchant.com&wallet=0x...&amount=500