Security Headers Checker - Bulk HSTS, CSP Audit (A+ to F)

✅ Tested daily with its default input (Apify's automated QA plus our own smoke test before every release).

Security headers checker for one website or a thousand in a single run. Every URL gets a grade (A+ to F), a score out of 100 and a concrete list of what is missing or misconfigured (HSTS, CSP, X-Frame-Options and more): the kind of report pen-testers and compliance questionnaires ask for. $0.0009 per URL.

Checked per URL

• Strict-Transport-Security: present, max-age (≥ 180 days), includeSubDomains, preload
• Content-Security-Policy: present, report-only, 'unsafe-inline' / 'unsafe-eval' in script sources, frame-ancestors
• X-Frame-Options (or CSP frame-ancestors), X-Content-Type-Options: nosniff
• Referrer-Policy, Permissions-Policy
• Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, Cross-Origin-Embedder-Policy
• Version leaks in Server, X-Powered-By, X-AspNet-Version and similar headers
• Cookies: Secure, HttpOnly and SameSite flags (cookie names only — values are never stored)
• HTTP → HTTPS redirect of the host

Output example

{
  "url": "https://example.org", "status": 200, "grade": "C", "score": 55,
  "hsts": "max-age=31536000; includeSubDomains", "csp": null, "xFrameOptions": "SAMEORIGIN",
  "httpsRedirect": true, "versionLeaks": {"x-powered-by": "PHP/8.1.2"},
  "missing": ["content-security-policy", "permissions-policy", "cross-origin-opener-policy"],
  "issues": ["headers reveal software/version: x-powered-by: PHP/8.1.2", "missing content-security-policy"]
}

The OUTPUT record gives a compact url → grade map for dashboards and alerting.

Scoring

Weights: CSP 25, HSTS 20, X-Frame-Options 10, X-Content-Type-Options 10, Referrer-Policy 10, Permissions-Policy 10, COOP/CORP/COEP 5 each. Deductions for version leaks, insecure cookies and a missing HTTPS redirect. A+ requires a score of 95+ with both CSP and HSTS.

Input

Field	Default	Description
urls	–	Pages or domains
checkHttpRedirect	true	Also test http:// → https://
timeoutSecs	20	Per-request timeout

Pricing (pay per event)

• $0.0009 per URL graded. Unreachable URLs are reported for free.

Notes

One normal GET request per URL (plus one http:// request when the redirect check is on). This is a passive header review, not a vulnerability scan — no payloads, no crawling, no personal data.

Use with AI agents (MCP)

This Actor can be used as a tool by AI agents (Claude, Cursor, VS Code, other MCP clients) through the official Apify MCP server:

• Add only this Actor as a tool: https://mcp.apify.com?tools=admirala/http-security-headers-checker (sign in with OAuth or an Apify API token).
• Or connect https://mcp.apify.com and let the agent find it with search-actors (e.g. "security headers"), read the input schema with fetch-actor-details and run it with call-actor.

Example input an agent can pass:

{
  "urls": [
    "https://github.com",
    "http://example.com"
  ]
}

Cost per call: $0.0009 per URL graded; unreachable URLs are free. Results come back as dataset items (get-dataset-items).

FAQ

How do I check a website's security headers? Add the URL to urls. Each row has grade, score, the header values, missing headers and an issues list.

Is this a vulnerability scanner? No. It is a passive review of response headers with one normal GET request (plus one http:// request for the redirect check).

How is the grade calculated? Weighted headers (CSP 25, HSTS 20, ...) minus deductions for version leaks, insecure cookies and a missing HTTPS redirect; A+ needs 95+ with CSP and HSTS.

Related actors

• SSL Certificate Checker - Bulk Expiry, Chain & TLS
• Website Uptime Monitor - Status, Response Time & SSL
• Domain Expiry Checker - Bulk WHOIS/RDAP Expiration Dates (coming soon to Apify Store)
• WHOIS Lookup Bulk - Domain RDAP, DNS Records & SSL
• SPF, DKIM & DMARC Checker - Bulk Email Deliverability Audit (coming soon to Apify Store)
• Tech Stack Detector - BuiltWith & Wappalyzer Alternative
• Broken Link Checker - Find 404s & Redirects (Crawl or List) (coming soon to Apify Store)