HTTP Security Headers Check (A+ to F grade) API

Grades a URL's HTTP security headers A+ to F (0-100) from one live fetch after up to 5 validated redirects. Per header: present, value, rating, points, issue, fix for HSTS, Content-Security-Policy (unsafe-inline, unsafe-eval, wildcards, frame-ancestors), X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP, COEP, CORP; Server/X-Powered-By version leaks; cookie Secure, HttpOnly, SameSite flags; missing list, summary. DNS via Cloudflare DoH.

$0.005 per call  USDC over x402 v2 on Base, Polygon, Arbitrum, Avalanche or Sei. No signup, no API key. Requests that fail or match nothing are not charged.

Endpoint

GET https://web.kit-rx.com/v1/web/headers

Parameters

Example request

https://web.kit-rx.com/v1/web/headers?url=https%3A%2F%2Fgithub.com

Without payment the server answers 402 Payment Required with the price (5000 atomic USDC) in the PAYMENT-REQUIRED header. Any x402 v2 client pays and retries automatically. A request with no parameters runs this example.

curl -i "https://web.kit-rx.com/v1/web/headers?url=https%3A%2F%2Fgithub.com"

Pay from an agent

AgentCash: fetch the URL. OpenDexter MCP: x402_fetch. Kit Rx MCP server: https://web.kit-rx.com/mcp. Code:

import { x402Client } from "@x402/core/client";
import { registerExactEvmScheme } from "@x402/evm/exact/client";
import { wrapFetchWithPayment } from "@x402/fetch";
import { privateKeyToAccount } from "viem/accounts";

const client = new x402Client();
registerExactEvmScheme(client, { signer: privateKeyToAccount(process.env.BUYER_KEY) });
const pay = wrapFetchWithPayment(fetch, client);
const res = await pay("https://web.kit-rx.com/v1/web/headers?url=https%3A%2F%2Fgithub.com");
console.log(await res.json());

Example response

{
  "query": {
    "url": "https://github.com"
  },
  "result": {
    "input_url": "https://github.com/",
    "final_url": "https://github.com/",
    "status": 200,
    "https": true,
    "redirect_count": 0,
    "redirect_not_followed": null,
    "grade": "B",
    "score": 78,
    "max_score": 100,
    "summary": "Grade B (78/100): 5 of 9 checked headers rated good; missing permissions-policy, cross-origin-opener-policy, cross-origin-embedder-policy, cross-origin-resource-policy; 1 cookie(s) missing flags.",
    "headers": {
      "strict-transport-security": {
        "present": true,
        "value": "max-age=31536000; includeSubdomains; preload",
        "rating": "good",
        "points": 25,
        "max_points": 25,
        "issue": null,
        "fix": null
      },
      "content-security-policy": {
        "present": true,
        "value": "default-src 'none'; base-uri 'self'; child-src github.github…",
        "rating": "good",
        "points": 25,
        "max_points": 25,
        "issue": null,
        "fix": null
      },
      "permissions-policy": {
        "present": false,
        "value": null,
        "rating": "missing",
        "points": 0,
        "max_points": 10,
        "issue": "No Permissions-Policy: powerful browser features (camera, microphone, geolocation) are not restricted.",
        "fix": "Add Permissions-Policy disabling unused features, e.g. camera=(), microphone=(), geolocation=()."
      }
    },
    "missing": [
      "permissions-policy",
      "cross-origin-opener-policy",
      "cross-origin-embedder-policy",
      "cross-origin-resource-policy"
    ],
    "cookies": {
      "count": 3,
      "checked": [
        {
          "name": "_octo",
          "secure": true,
          "http_only": false,
          "same_site": "lax",
          "issues": [
            "no HttpOnly"
          ]
        }
      ],
      "deduction": -2
    },
    "deductions": [
      {
        "reason": "cookie flags missing (1 of 3 cookies)",
        "points": -2
      }
    ],
    "subrequests": 3
  },
  "sources": [
    {
      "name": "Cloudflare DNS over HTTPS (JSON API)",
      "url": "https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/make-api-requests/dns-json/"
    },
    {
      "name": "Live HTTP(S) fetch of the site",
      "url": "https://github.com/"
    }
  ],
  "notes": [
    "Headers describe the response served to the Kit Rx fetcher (User-Agent KitRx/1.0); a site may answer browsers or other clients differently."
  ],
  "attribution": [
    "DNS resolved via Cloudflare 1.1.1.1 DNS-over-HTTPS."
  ],
  "generated_at": "2026-11-15T00:31:20.681Z"
}

Kit Rx Website Security, TLS & Markdown: Website tools for AI agents: security headers grade, SSL/TLS certificate check, page and document to Markdown, site and agent-readiness checks, paid per call over x402. Machine-readable: OpenAPI, llms.txt, /.well-known/x402, agent skills.