{"slug":"2s-io-api-security-http-headers-41ccae","title":"Fetch a URL and grade its HTTP security headers","host":"2s.io","method":"GET","resource":"https://2s.io/api/security/http-headers","category":"other","description":"Fetch a URL and grade its HTTP security headers. Pass url (scheme optional — defaults to https). Returns an overall letter grade + score, the list of present/missing headers, and a per-header analysis with the live value and specific issues for: Strict-Transport-Security (HSTS max-age/includeSubDoma","price_listed":0.0045,"price_asked":0.0045,"state":"answering","state_label":"Answering","checks_7d":1,"answered_7d":1,"latency_ms_median":247,"reported_calls_30d":2,"reported_payers_30d":1,"networks":["eip155:8453","solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"],"badge":"unverified","paid_checks_7d":0,"paid_ok_7d":0,"example_input":{"method":"GET","queryParams":{"url":"https://example.com"},"type":"http"},"output_schema":{"$schema":"https://json-schema.org/draft/2020-12/schema","properties":{"input":{"properties":{"method":{"const":"GET"},"queryParams":{"properties":{"url":{"description":"URL to analyze (scheme optional).","type":"string"}},"required":["url"]},"type":{"const":"http"}},"required":["type","method","queryParams"],"type":"object"}},"required":["input"],"type":"object"},"history":[{"day":"2026-10-02","reachable":true,"status":402,"valid_402":true,"asked_usdc":0.0045,"price_match":true,"latency_ms":247,"error":null}],"description_full":"Fetch a URL and grade its HTTP security headers. Pass url (scheme optional — defaults to https). Returns an overall letter grade + score, the list of present/missing headers, and a per-header analysis with the live value and specific issues for: Strict-Transport-Security (HSTS max-age/includeSubDomains), Content-Security-Policy (flags 'unsafe-inline'/'unsafe-eval'/missing default-src), X-Frame-Options or CSP frame-ancestors (clickjacking), X-Content-Type-Options (nosniff), Referrer-Policy, Permissions-Policy, and Cross-Origin-Opener/Resource-Policy. Also flags Server/X-Powered-By info disclosure. Analyzed from the target's LIVE response headers through an SSRF-guarded fetch (private/loopback targets refused) — an LLM cannot see a site's current headers. For web-app security review, vendor assessment, and CI gates.","last_updated":"2026-10-02T01:27:06.887Z","schemes":["exact"]}