HTTP security headers checker API

$0.01 per call · failed calls are never charged · no account or subscription: pay per call with a card key or USDC

Fetch a public URL and grade its HTTP security headers: HSTS, Content-Security-Policy, framing protection, nosniff, Referrer-Policy and Permissions-Policy, plus version leaks (Server, X-Powered-By) and cookies missing Secure, HttpOnly or SameSite. Returns a grade A-F, a score and each check with its value. Use to review a site's basic web security; for DNS and email records use domain. Private hosts are refused with 400, uncharged.

When to use it

Run it free (25 free calls) Buy credits by card (from $1) Example result (JSON)

Try it with your own inputs

Public http(s) URL to check

Uses one of your 25 free calls. Nothing is charged, and a call that fails is not counted.

Inputs

NameTypeDescription
url (required)stringPublic http(s) URL to check

Request

Over HTTP, with a card key from /credits:

curl -H "Authorization: Bearer adt_…" "https://tools.funwords.eu/http/security-headers?url=https%3A%2F%2Fexample.com"

Or one of your 25 free calls, no key:

curl "https://tools.funwords.eu/http/security-headers?url=https%3A%2F%2Fexample.com&trial=1"

Without a key, the same URL answers 402 Payment Required with x402 and MPP terms, so an agent with a wallet pays per call in USDC (Base, Polygon, Arbitrum or Solana over x402; Base or Tempo over MPP) and retries.

Example result

{
  "url": "https://example.com",
  "finalUrl": "https://example.com/",
  "status": 200,
  "grade": "C",
  "score": 60,
  "checks": [
    {
      "header": "strict-transport-security",
      "status": "fail",
      "value": null,
      "note": "missing: browsers may load the site over plain HTTP"
    }
  ]
}

From an AI agent (MCP)

Add the MCP server to Claude, Cursor or any MCP client. This tool is http_security_headers, and the first 25 successful calls are free:

https://tools.funwords.eu/mcp

Questions

Does it scan the whole site?

No, it checks the response headers of the URL you give.

How do I pay?

Each successful call costs $0.01; failed calls are not charged. The first 25 calls are free. Then pay with card credits (from $1; the key goes in an Authorization header or, for clients that can only fetch a URL, as api_key= in the URL) or per call in USDC over x402 or MPP. No account is needed.

Related tools