All projects matching “security headers”

Audit a URL's HTTP security headers over a single body-free (HEAD) request. Grades Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, flags information-leak headers (Server, X-Powered-By), and returns the parsed values plus advisory warnings. Clean JSON for security and pentest automation.

Response headers and security-header report for a URL

Fetches a public http(s) URL (GET, up to 5 redirects, 10s timeout, body never read) and grades its security headers A+ to F. Returns score, present and missing headers, per-header findings with copy-paste fix values, and cookie flag issues.

Domain OSINT, TLS Certificate & Security Headers Recon (/v1/domain-osint) — Inspects live IPv4/IPv6 DNS resolution, TLS certificate issuer/expiry, and HTTP security grade. (https://domain-osint.agentdiet.dev/v1/domain-osint)

Inspect a public URL: HEAD redirect trace, DNS A/AAAA observations and security headers in one report. At most 4 targets, no page body. Includes timestamps, partial-result warnings and factual findings; no safety or reputation verdict.

Request an https URL and report whether it is reachable, its status, every redirect hop with timings, key and security headers (HSTS, CSP and others), and the TLS certificate with its issuer, the names it covers and the days until it expires. An unreachable URL is a result too, with the reason.

One call, whole outside view of a domain: DNS records, email authentication grade (SPF, DMARC, MTA-STS), TLS certificate expiry and chain, post-quantum key exchange (X25519MLKEM768), HTTPS security headers, and a to-do list.

Request an https URL and report whether it is reachable, its status, every redirect hop with timings, key and security headers (HSTS, CSP and others), and the TLS certificate with its issuer, the names it covers and the days until it expires. An unreachable URL is a result too, with the reason.

Performs comprehensive URL health checks, measuring response time, status code, security headers, and TLS/SSL certificate validity. Route: GET /paid/health-check?url=https://example.com. Ideal for automated monitoring and endpoint auditing.

Website audit bundle for local business websites and lead qualification: performance (browser-measured), security headers and TLS, SEO basics, accessibility and AI-crawler visibility of one public page, with section scores, grades and prioritized findings, in one call.

Website trust check: verdict (trustworthy_likely/caution/risky) with reasons from domain age (RDAP), DNS (A/MX/NS), HTTPS reachability and redirect chain, security headers, phishing/malware list snapshots, brand lookalike/typosquat detection, tech fingerprint and page title. Use when an agent is about to open, click, submit credentials or payment to, recommend or trust an unfamiliar URL or website

Security headers audit for a URL — HSTS, CSP, clickjacking, cookie flags, info leaks. Returns score 0-100, findings with severity and fixes.

Technical SEO audit of one page: HTTP status, redirect chain, title and meta description length, H1 count, canonical, robots meta, hreflang, Open Graph and Twitter tags, JSON-LD types, images without alt text, link counts, security headers (HSTS, CSP, X-Frame-Options), technology detection (CMS, framework, analytics, CDN) and a prioritised issue list with a 0-100 score. Static HTML only; honours r

Premium low-cost public domain/company enrichment for AI agents. One call combines homepage metadata, JSON-LD organization evidence, public social/about/contact-page links, A/AAAA/MX/SPF/DMARC DNS, security headers, technology hints, redirects, and evidence hashes. Public HTTPS + DNS only.

Public domain DNS, mail configuration and HTTP security headers

Passive HTTP security header review for an authorized external target (no exploitation; platform hosts blocked)

Inspect a public webpage for automation readiness, integration links, forms, robots policy, and security headers.

Audit a public HTTPS x402 API without payment: HTTP 402 challenge metadata, Bazaar and well-known discovery, OpenAPI 3.1 operation schemas and payment declarations, redirects, latency, and security headers.

Use when you need to know what a website is built with (CMS, frameworks, analytics, CDN, hosting), who hosts its email and DNS, and how good its security headers are. Up to 3 domains per call; fetches each homepage once, follows robots.txt.

Queries target URL headers to score security configurations (HSTS, CSP, X-Frame-Options).

Resolve ONE DNS record type for a domain -- the cheapest, narrowest domain-check endpoint. For all record types at once, use /domain/intelligence. For a bundled DNS+TLS+headers audit, use /web/audit (raw) or /security/posture (scored). For mail-security plus a scored verdict, use /domain/due-diligence.

Email authentication check (SPF, DKIM, DMARC): Check a domain's email authentication and spoofing risk from public DNS: MX and mail provider, SPF (record, all-qualifier, DNS lookup count vs the 10 limit), DMARC policy/pct/rua, DKIM at 30 common selectors, MTA-STS, TLS-RPT, BIMI. Returns grade, spoof

Web page to Markdown, $0.001 USDC per call: Fetch a public web page and return LLM-ready Markdown: title, meta description, canonical, language, main content (scripts/nav/footer stripped, headings/lists/links kept), first 50 absolute links, word count. Honours robots.txt (disallowed → 403, not charged). No JS rendering; non-HTML → 415. max_chars 500-50000 (default 20000). No params = runs the exam