Makes a live HEAD request to the target domain from the Cloudflare edge, follows
up to 5 redirects, and returns the full redirect chain, final HTTP status, key
response headers, a security header score, and any third-party surveillance
actors referenced in the Content-Security-Policy header.
Use this tool when:
- You want to verify whether a site enforces HTTPS and HSTS.
- You need to inspect what third-party scripts a site loads via its CSP header.
- You are assessing a domain's security posture before trusting it.
- You want to detect surveillance actors embedded in a site's CSP.
Do NOT use this tool when:
- You need tracker database data (category, score, entity) — use `get_domain` instead.
- You need the technology stack (CMS, framework) — use `intel_stack` instead.
- You need robots.txt AI crawler policy — use `intel_robots` instead.
Inputs:
- `domain` (query, required): Domain to probe. Can include or omit `https://`.
Examples: `nytimes.com`, `https://example.com`.
Returns:
- `reachable`: false if the domain did not respond within 6 seconds.
- `redirect_chain`: each hop with URL, status code, and Location header.
- `security_headers.score`: 0-100 based on presence of HSTS, CSP, X-Content-Type,
X-Frame-Options, Referrer-Policy.
- `security_headers.missing`: list of headers absent.
- `csp_actors`: known surveillance actors detected in the CSP header.
- `error`: set if the connection failed.
Cost:
- Free. No API key required.
Latency:
- Typical: 1-3s (outbound fetch), p99: 6s (timeout). Plan for async if chaining calls.