Service details

HTTP Security and CORS Inspection

Check a deployed URL for security-header and cross-origin configuration issues. Your assistant calls the service and brings the result back into your task.

Inspect one public URL for observed security headers and cross-origin configuration

0.005 USDC per accepted request

Paid only. No free trial for this operation.

Use this service →

This operation needs paid setup. New to Mekler? Start with a free sample task →

Know its boundaries.

Penetration testing, authenticated scanning, exploits, state-changing requests, full CSP interpretation or TLS certificate analysis.

Data handling

Supplied inputs, source results and proofs are excluded from telemetry. Completed results remain encrypted for 30 day original-proof recovery. Public URLs use robots/DNS controls; currency and vehicle inputs go only to the documented fixed public source.

Input example and exact contract

{
  "url": "https://mekler.ai/",
  "origin": "https://mekler.ai",
  "requested_method": "GET",
  "request_headers": [],
  "request_id": "http-security-example-001"
}

API reference: input, output and error schemas →

Example output

{
  "status": "ok",
  "url": "https://mekler.ai/",
  "observed_at": "2026-10-20T00:00:00Z",
  "http_status": 200,
  "origin": "https://mekler.ai",
  "requested_method": "GET",
  "request_headers": [],
  "response_headers": {
    "x-content-type-options": "nosniff",
    "access-control-allow-origin": "*",
    "access-control-allow-methods": "GET, HEAD"
  },
  "preflight": {
    "http_status": 200,
    "url": "https://mekler.ai/",
    "headers": {
      "x-content-type-options": "nosniff",
      "access-control-allow-origin": "*",
      "access-control-allow-methods": "GET, HEAD"
    }
  },
  "findings": [
    {
      "code": "hsts_absent",
      "severity": "info",
      "evidence": "No HSTS response header.",
      "recommendation": "Consider HSTS after confirming HTTPS coverage for the intended host scope."
    },
    {
      "code": "csp_absent",
      "severity": "info",
      "evidence": "No enforced CSP response header.",
      "recommendation": "Consider a tested CSP appropriate to the application; report-only is not enforcement."
    }
  ],
  "limitations": [
    "Passive GET and credential-free OPTIONS observations only; no cookies, authorization, exploit attempts or state-changing method is sent.",
    "Observed policies may vary by route, origin, browser and authentication. This is not a vulnerability scan or a browser enforcement/safety certification.",
    "CSP syntax/effective-policy analysis and TLS certificate inspection are outside this operation."
  ]
}

Calling, result interpretation and recovery

Calling

Endpoint: POST /v1/web/headers/check-security-policy
Content type: application/json
Input: All fields, formats, defaults and limits are specified in requestBody. request_id must be 16–64 ASCII letters, digits, underscores or hyphens; use a fresh value per new purchase.

Interpret the result

Status: ok means the documented bounded operation completed; inspect explicit coverage and limitations.
Result: Response schema describes each output. Null means missing/unknown, never measured zero.
Recovery: Use the original body and payment proof after timeout, pending settlement or quote expiry.

Limits

Request bytes

24000

Semantics

No work occurs on unsigned quotes. Normalize and bind the complete input before payment.
Successful results are encrypted for 30 day original-proof recovery.
Incomplete operation or source/storage failure is uncharged. A completed diagnostic or zero-match lookup is charged.

Payment and recovery

Price

0.005 native USDC per completed operation

Network

Solana mainnet or Base mainnet

Protocol

x402 v2 exact

Quote

POST the intended JSON unsigned for one input-bound 402; no work/source retrieval occurs. Sign one offer and resend identical JSON. Work and encrypted storage complete before settlement.

Authorization

Choose one accepts entry with a standard x402 v2 client. Check native USDC, network, recipient, amount and intended input before signing. Solana uses an SVM transaction; Base uses an EOA EIP-3009 authorization (USD Coin version 2). Send the proof with identical JSON input. No API key, token approval, bridge or Solana wallet is needed for Base. Never automatically fall back to another network.

Retry

Preserve identical JSON and original proof for 30 day result recovery; do not buy again after a timeout or pending result. Fresh request_id creates a new paid operation.

Finality

A 202 is pending. Finalized delivery carries PAYMENT-RESPONSE; provisional delivery is separately labeled and does not establish finality. Preserve the original proof instead of buying again.

Expiry

Ongoing service under recurring monthly authority. Budget warnings do not stop service. Short-lived quotes and recovery retention still expire.

Networks

solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp
eip155:8453

Assets

Solana:5eykt4usfv8p8njdtrepy1vzqkqzkvdp: EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v
Eip155:8453: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913

Fees

CDP sponsors the payment transaction gas on both networks. The service price is the same on either network; wallet funding or exchange fees are separate.

Request binding

The server authenticates the complete quote and input and atomically binds the first accepted authorization to them. Standard Base EIP-3009 signs the money terms and nonce, not HTTP content. Keep signatures private; do not reuse an authorization for another quote, operation or body.