Security Header Check

Check a site's HTTP response headers against good practice (HSTS, CSP, X-Frame-Options and more) and grade it from A to F.

Pay by wallet (x402) header-security-check

Example

Input

{
  "url": "https://google.com"
}

Answer

{
  "url": "https://google.com",
  "cors": null,
  "grade": "F",
  "score": 20,
  "server": "gws",
  "missing": [
    {
      "header": "strict-transport-security",
      "severity": "high",
      "recommendation": "Add: Strict-Transport-Security: max-age=31536000; includeSubDomains"
    },
    {
      "header": "content-security-policy",
      "severity": "high",
      "recommendation": "Add Content-Security-Policy to prevent XSS and injection attacks"
    },
    {
      "header": "x-content-type-options",
      "severity": "medium",
      "recommendation": "Add: X-Content-Type-Options: nosniff to prevent MIME sniffing"
    },
    {
      "header": "referrer-policy",
      "severity": "medium",
      "recommendation": "Add: Referrer-Policy: strict-origin-when-cross-origin"
    },
    {
      "header": "permissions-policy",
      "severity": "medium",
      "recommendation": "Add Permissions-Policy to restrict browser features (camera, microphone, etc.)"
    }
  ],
  "present": [
    {
      "value": "SAMEORIGIN",
      "header": "x-frame-options",
      "status": "present"
    },
    {
      "value": "0",
      "header": "x-xss-protection",
      "status": "present (deprecated header)"
    }
  ],
  "response_status": 200
}

Inputs

Field	Type	Required	What it is
`url`	string	Yes	—

Output fields

How reliably each field appears in a successful answer.

Field	Type	Appears
`grade`	string	Always (present in every successful answer)
`score`	integer	Always (present in every successful answer)
`missing`	array	Always (present in every successful answer)
`present`	array	Always (present in every successful answer)

How to call it

The same tool through each route. MCP clients reach it through Strale’s server at https://api.strale.io/mcp; the call below is what the agent sends.

# Needs an API key. max_price_cents caps what this call may cost.
curl -X POST https://api.strale.io/v1/do \
  -H "Authorization: Bearer $STRALE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "capability_slug": "header-security-check",
    "inputs": {
      "url": "https://google.com"
    },
    "max_price_cents": 5
  }'

{
  "tool": "strale_execute",
  "arguments": {
    "slug": "header-security-check",
    "inputs": {
      "url": "https://google.com"
    },
    "max_price_cents": 5
  }
}

import { Strale } from "straleio";

const strale = new Strale({ apiKey: process.env.STRALE_API_KEY! });
const result = await strale.do({
  capability_slug: "header-security-check",
  inputs: {
    "url": "https://google.com"
  },
  max_price_cents: 5,
});

import os
from straleio import Strale, DoRequest

strale = Strale(api_key=os.environ["STRALE_API_KEY"])
result = strale.do(DoRequest(
    capability_slug="header-security-check",
    inputs={
        "url": "https://google.com",
    },
    max_price_cents=5,
))

# No account. The first request answers 402 with the price in USDC;
# an x402 client pays it from your wallet and repeats the request.
curl -i 'https://api.strale.io/x402/v2/header-security-check?url=https%3A%2F%2Fgoogle.com'

Limitations

Only HTTP security headers are checked
Checks HTTP security headers only — does not assess server configuration, TLS settings, or application-level vulnerabilities
What to do instead: Combine with ssl-check for TLS assessment and use a full DAST scanner for application-level security testing