One HEAD request against a URL, returning its parsed HTTP security headers as JSON: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, plus advisory warnings and any disclosed Server or X-Powered-By. $0.01 per call on Base. Operated by x402 Atlas.
Pay from $0.01 per request in USDC on Base / Solana, settled onchain via the x402 protocol, no signup, no API key needed.
ASSESSMENT
updated 4h agoEvidence-backed signals, not a single score. Click any chip for the proof. Measured values stay read-only; unknown is honest.
reliability 100%
- uptime 24h
- 100%
- uptime 7d
- 100%
- uptime 30d
- 100%
- uptime 90d
- 100%
- response p95
- 822ms
- avg response
- 471ms
- total checks
- 47
compliance A (11/11)
11 of 11 x402 conformance checks pass. Full checklist below.
price $0.01 (p62 in Data)
- price (min)
- $0.01
- category percentile (min)
- p62 in Data
- endpoints / prices
- 1 / 1
- model
- flat
- stability
- 100%
risk clean
No deterministic risk flag. Risk fires only on an exact blocklist match, or a reserved-brand name with a mismatched verified payTo. Never from low uptime, a high price, or a model guess.
traction $0.0015 30d · 0 buyers
- volume 30d
- $0.0015
- buyers 30d
- 0
- settlements 30d
- 0
- last settlement
- 2026-07-15
- top buyer share
- 67% of 30d volume
- trend 7d vs 30d
- 2.86x the 30d daily rate
- networks
- eip155:8453, solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdpKuc147dw2N9d
Attributed pro-quota: this payout address is shared, so volume and buyers are the operator-level figure divided by the services sharing it. A declared convention, not an individually observed measure, and still a conservative undercount.
Top buyer share is a concentration signal, not part of the ranking score.
WHAT IT DOES
ai-derivedAudits a URL's HTTP security headers over a single body-free (HEAD) request
- category
- security-headers
AI-generated summary. The measured data is never altered by it.
ENDPOINTS
| METHOD | PATH | DESCRIPTION | PRICE | NETWORK | ASSET |
|---|---|---|---|---|---|
| GET | / | $0.01 | Base/Solana | USDC |
REQUEST / RESPONSE EXAMPLE
An unpaid request to GET / returns HTTP 402 with the payment terms. Settle onchain via your facilitator, then retry with the X-Payment header.
curl -i 'https://headers.use.x402atlas.com/'
// 402 response (captured by monitor) · 1 payload · click to expand
[
{
"error": "Payment required",
"accepts": [
{
"asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
"extra": {
"name": "USD Coin",
"tier": "standard",
"version": "2",
"merchant": "x402Atlas"
},
"payTo": "0x7f8043c400799643bcb62B41B84b297a8Ecb7b9c",
"amount": "10000",
"scheme": "exact",
"network": "eip155:8453",
"maxTimeoutSeconds": 300
},
{
"asset": "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v",
"extra": {
"tier": "standard",
"feePayer": "Hc3sdEAsCGQcpgfivywog9uwtk8gUBUZgsxdME1EJy88",
"merchant": "x402Atlas"
},
"payTo": "ASt6xvRyQ7ntERsmcYVMdLqZvz1GEN8Fzexzq62tXrNQ",
"amount": "10000",
"scheme": "exact",
"network": "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp",
"maxTimeoutSeconds": 300
}
],
"resource": {
"url": "https://headers.use.x402atlas.com/",
"mimeType": "application/json",
"description": "Audit a URL's HTTP security headers over a single body-free (HEAD) request. Grades Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, flags information-leak headers (Server, X-Powered-By), and returns the parsed values plus advisory warnings. Clean JSON for security and pentest automation.",
"serviceName": "HTTP Security Headers Check"
},
"extensions": {
"bazaar": {
"info": {
"input": {
"type": "http",
"method": "GET",
"queryParams": {
"url": "https://example.com/"
}
},
"output": {
"type": "json",
"example": {
"url": "https://example.com/",
"headers": {
"server": null,
"x_powered_by": null,
"referrer_policy": "strict-origin-when-cross-origin",
"x_frame_options": "DENY",
"permissions_policy": null,
"x_content_type_options": "nosniff",
"content_security_policy": "default-src 'self'",
"strict_transport_security": {
"value": "max-age=31536000; includeSubDomains",
"max_age": 31536000,
"preload": false,
"include_subdomains": true
}
},
"warnings": [
"no Permissions-Policy header (powerful browser features are not restricted)"
],
"queried_at": "2026-07-03T12:00:00Z",
"status_code": 200
}
}
},
"tags": [
"http",
"headers",
"security",
"hsts",
"csp",
"x-frame-options",
"posture"
],
"schema": {
"type": "object",
"$schema": "https://json-schema.org/draft/2020-12/schema",
"required": [
"input"
],
"properties": {
"input": {
"type": "object",
"required": [
"type",
"method"
],
"properties": {
"type": {
"type": "string",
"const": "http"
},
"method": {
"enum": [
"GET"
],
"type": "string"
},
"queryParams": {
"type": "object",
"required": [
"url"
],
"properties": {
"url": {
"type": "string",
"format": "uri",
"description": "Absolute http/https URL to audit. Host must be a hostname (not an IP literal), not \"localhost\", and not under a reserved suffix (.local, .internal, .localdomain, .lan, .test). Non-default ports must be allowlisted. Redirects are not followed."
}
}
}
},
"additionalProperties": false
},
"output": {
"type": "object",
"required": [
"type"
],
"properties": {
"type": {
"type": "string"
},
"example": {
"type": "object",
"required": [
"url",
"status_code",
"queried_at",
"headers",
"warnings"
],
"properties": {
"url": {
"type": "string",
"description": "The audited URL, exactly as given"
},
"headers": {
"type": "object",
"properties": {
"server": {
"type": [
"string",
"null"
],
"description": "Server header value, if disclosed by the target"
},
"x_powered_by": {
"type": [
"string",
"null"
],
"description": "X-Powered-By header value, if disclosed by the target"
},
"referrer_policy": {
"type": [
"string",
"null"
]
},
"x_frame_options": {
"type": [
"string",
"null"
]
},
"permissions_policy": {
"type": [
"string",
"null"
]
},
"x_content_type_options": {
"type": [
"string",
"null"
]
},
"content_security_policy": {
"type": [
"string",
"null"
]
},
"strict_transport_security": {
"type": [
"object",
"null"
],
"properties": {
"value": {
"type": "string",
"description": "Raw Strict-Transport-Security header value"
},
"max_age": {
"type": [
"integer",
"null"
],
"description": "Parsed max-age in seconds; null if absent or unparseable"
},
"preload": {
"type": "boolean"
},
"include_subdomains": {
"type": "boolean"
}
}
}
},
"description": "Graded, normalized security headers. Each field is null when the header is absent from the response"
},
"warnings": {
"type": "array",
"items": {
"type": "string"
},
"description": "Human-readable posture advisories, e.g. missing or weak headers"
},
"queried_at": {
"type": "string",
"format": "date-time",
"description": "UTC timestamp the audit was performed"
},
"status_code": {
"type": "integer",
"description": "HTTP status code returned by the target for the HEAD request"
}
}
}
}
}
}
},
"category": "domain-intelligence",
"routeTemplate": ":var1"
}
},
"x402Version": 2
}
] UPTIME
RECENT CHECKS
OVER TIME
All charts share the 24h window selected here. Every series is also served as JSON at /api/v1/services/http-security-headers-check/price, /scores, /volume and /buyers. On-chain volume and distinct buyers are measured over the service's settlement address and are a conservative undercount (only settlements that reach a measured facilitator are counted).
Shared payout address (19 other services). These bars are the full shared address (operator-level), so do not sum them across the services that share it. Where a per-service figure is attributed, the assessment block and the ranking, it is the address total divided pro-quota by the 20 services sharing it: a declared convention, not an individually observed measure.
Shared payout address (19 other services). These bars are the full shared address (operator-level), so do not sum them across the services that share it. Where a per-service buyer count is attributed, the assessment block and the ranking, it is divided pro-quota by the 20 services sharing the address and can be fractional: a declared convention, not an individually observed measure.
COMPLIANCE
11/11 checks pass · grade A- 402 payload captured
- accepts[] array present
- payTo address recoverable
- payTo at accepts[0].payTo (conformant shape)
- payTo is a valid on-chain address
- atomic price declared
- atomic price in a sane range
- asset (token) address declared
- network resolves to CAIP-2
- payment scheme declared
- served over HTTPS
EMBED THIS BADGE
<a href="https://x402-list.com/services/http-security-headers-check?utm_source=badge&utm_medium=referral&utm_campaign=embed"> <img src="https://x402-list.com/badge/http-security-headers-check.svg" alt="HTTP Security Headers Check listed on x402-list" height="28"> </a>
[](https://x402-list.com/services/http-security-headers-check?utm_source=badge&utm_medium=referral&utm_campaign=embed)
<a href="https://x402-list.com/services/http-security-headers-check?utm_source=badge&utm_medium=referral&utm_campaign=embed"> <img src="https://x402-list.com/badge/http-security-headers-check.svg?data=uptime" alt="HTTP Security Headers Check uptime on x402-list" height="28"> </a>