Index onlineMerchant portal
Api Endpoint

HeaderGuard Analyzer

Fetches a URL and evaluates 10 security-critical response headers (CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, X-XSS-Protection, CORP, COEP, COOP), detects anti-patterns, and returns an overall security grade (A–F).

Open interactive test console

Offering

Provider
netintel.dev
Method
GET
Offering type
Api Endpoint
Transport type
http
Category
Security
Delivery
Not provided
Pricing model
Not provided
x402 version
2

Endpoint context

URL
https://netintel.dev/security-headers/analyze
MIME type
application/json
First seen
2026-10-16T01:50:14.534Z
Last seen
Tags
security headers check, http security headers, csp, hsts, website security audit

Website

Payment pricing

x402 payment terms are the authoritative price for calling this endpoint.

Payment option 1
0.01 USDC
Atomic price: 10000 · Network: eip155:8453 · Asset: USDC · Scheme: exact
Payment option 2
0.01 USDC
Atomic price: 10000 · Network: solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp · Asset: USDC · Scheme: exact
Raw x402 terms
[
  {
    "scheme": "exact",
    "network": "eip155:8453",
    "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
    "amount": "10000",
    "payTo": "0xdaDc335482AD545296Fd7b28518A251fFCbEb9Df"
  },
  {
    "scheme": "exact",
    "network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
    "asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
    "amount": "10000",
    "payTo": "8FVeybWnB4dYrxTuPK7WzFZNAiEcFVaDLFnKpRwVGr5s"
  }
]

Observed health

Status
Healthy
Latest latency
101 ms
Average latency
223 ms
HTTP status
402
Last checked
Reachability
100% over 12 checks

Latency is measured to the first response headers. A reachable result does not verify response accuracy or merchant identity.

Input schema

{
  "type": "object",
  "properties": {
    "type": {
      "type": "string",
      "const": "http"
    },
    "method": {
      "type": "string",
      "enum": [
        "GET"
      ]
    },
    "queryParams": {
      "type": "object",
      "properties": {
        "target": {
          "type": "string",
          "description": "URL or domain to audit security headers for (e.g. https://example.com)"
        }
      },
      "required": [
        "target"
      ]
    }
  },
  "required": [
    "type",
    "method"
  ],
  "additionalProperties": false
}

Output schema

{
  "type": "json",
  "example": {
    "meta": {
      "duration_ms": 312
    },
    "grade": "B",
    "score": 78,
    "errors": [],
    "target": "https://example.com",
    "results": {
      "headers": {
        "referrer-policy": {
          "reason": "Referrer-Policy is set to strict-origin-when-cross-origin",
          "status": "pass",
          "present": true,
          "raw_value": "strict-origin-when-cross-origin"
        },
        "x-frame-options": {
          "reason": "X-Frame-Options is set to DENY",
          "status": "pass",
          "present": true,
          "raw_value": "DENY"
        },
        "x-xss-protection": {
          "reason": "X-XSS-Protection not set — modern browsers use CSP instead",
          "status": "info",
          "present": false,
          "raw_value": null
        },
        "permissions-policy": {
          "reason": "Permissions-Policy not set — browser features not restricted",
          "status": "warn",
          "present": false,
          "raw_value": null
        },
        "x-content-type-options": {
          "reason": "X-Content-Type-Options is set to nosniff",
          "status": "pass",
          "present": true,
          "raw_value": "nosniff"
        },
        "content-security-policy": {
          "reason": "Content-Security-Policy is set with a strong policy",
          "status": "pass",
          "present": true,
          "raw_value": "default-src 'self'"
        },
        "strict-transport-security": {
          "reason": "HSTS enabled with max-age=31536000",
          "status": "pass",
          "present": true,
          "raw_value": "max-age=31536000; includeSubDomains"
        },
        "cross-origin-opener-policy": {
          "reason": "Cross-Origin-Opener-Policy not set",
          "status": "info",
          "present": false,
          "raw_value": null
        },
        "cross-origin-embedder-policy": {
          "reason": "Cross-Origin-Embedder-Policy not set",
          "status": "info",
          "present": false,
          "raw_value": null
        },
        "cross-origin-resource-policy": {
          "reason": "Cross-Origin-Resource-Policy not set",
          "status": "info",
          "present": false,
          "raw_value": null
        }
      },
      "summary": {
        "fail": 0,
        "info": 4,
        "pass": 6,
        "warn": 0
      },
      "final_url": "https://example.com/",
      "status_code": 200,
      "content_type": "text/html; charset=utf-8",
      "anti_patterns": [
        {
          "header": "x-powered-by",
          "reason": "Information leakage — reveals server framework",
          "severity": "warn",
          "raw_value": "Express"
        }
      ]
    },
    "service": "security-headers",
    "warnings": [],
    "timestamp": "2025-01-15T12:00:00.000Z",
    "deductions": [
      {
        "points": -5,
        "reason": "Permissions-Policy not set"
      },
      {
        "points": -2,
        "reason": "Cross-Origin-Resource-Policy not set"
      },
      {
        "points": -2,
        "reason": "Cross-Origin-Embedder-Policy not set"
      },
      {
        "points": -2,
        "reason": "Cross-Origin-Opener-Policy not set"
      },
      {
        "points": -3,
        "reason": "X-Powered-By header exposes server framework"
      }
    ]
  }
}