Security Header Inspection
inspect_security_headersRead-onlyIdempotent
Inspect security-relevant response headers of public URLs to quickly verify browser-facing security baseline before making security claims.
Instructions
Fetch a public URL and inspect security-relevant response headers before you claim that a product or endpoint has a strong browser-facing security baseline. Use this for quick due diligence on public apps and docs sites. It checks for common headers such as HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, and X-Content-Type-Options. It does not replace a real security review, authenticated testing, or vulnerability scanning.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | Public http(s) URL or bare domain to inspect. Bare domains are normalized to https:// automatically. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| inputUrl | No | Original user input when normalization changed it. | |
| url | Yes | Normalized URL that was fetched. | |
| accessible | Yes | True when the endpoint returned an HTTP response. | |
| status | No | HTTP status code returned by the endpoint. | |
| https | Yes | True when the normalized URL used https. | |
| presentCount | No | Number of tracked security headers that were present. | |
| score | No | Heuristic security-header score based on how many tracked headers were present. | |
| headers | No | Tracked response headers and their raw values when present. | |
| missingRecommended | No | Tracked headers that were not present on the response. | |
| error | No | Validation or network error when the request could not be completed. |