# Security Headers Checker - Bulk HSTS, CSP Audit (A+ to F) (`admirala/http-security-headers-checker`) Actor

Bulk HTTP security headers checker: HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, cookie flags and HTTPS redirect, graded A+ to F with a fix list. $0.0009 per URL.

- **URL**: https://apify.com/admirala/http-security-headers-checker.md
- **Developed by:** [Ja doei](https://apify.com/admirala) (community)
- **Categories:** Developer tools, SEO tools
- **Security:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $0.60 / 1,000 per url gradeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Security Headers Checker - Bulk HSTS, CSP Audit (A+ to F)

> ✅ **Tested daily** with its default input (Apify's automated QA plus our own smoke test before every release).

**Security headers checker** for one website or a thousand in a single run. Every URL gets a **grade (A+ to F)**, a score out of 100 and a concrete list of what is missing or misconfigured (HSTS, CSP, X-Frame-Options and more): the kind of report pen-testers and compliance questionnaires ask for. **$0.0009 per URL**.

### Checked per URL

- **Strict-Transport-Security**: present, `max-age` (≥ 180 days), `includeSubDomains`, `preload`
- **Content-Security-Policy**: present, report-only, `'unsafe-inline'` / `'unsafe-eval'` in script sources, `frame-ancestors`
- **X-Frame-Options** (or CSP `frame-ancestors`), **X-Content-Type-Options: nosniff**
- **Referrer-Policy**, **Permissions-Policy**
- **Cross-Origin-Opener-Policy**, **Cross-Origin-Resource-Policy**, **Cross-Origin-Embedder-Policy**
- **Version leaks** in `Server`, `X-Powered-By`, `X-AspNet-Version` and similar headers
- **Cookies**: `Secure`, `HttpOnly` and `SameSite` flags (cookie names only — values are never stored)
- **HTTP → HTTPS redirect** of the host

### Output example

```json
{
  "url": "https://example.org", "status": 200, "grade": "C", "score": 55,
  "hsts": "max-age=31536000; includeSubDomains", "csp": null, "xFrameOptions": "SAMEORIGIN",
  "httpsRedirect": true, "versionLeaks": {"x-powered-by": "PHP/8.1.2"},
  "missing": ["content-security-policy", "permissions-policy", "cross-origin-opener-policy"],
  "issues": ["headers reveal software/version: x-powered-by: PHP/8.1.2", "missing content-security-policy"]
}
```

The `OUTPUT` record gives a compact `url → grade` map for dashboards and alerting.

### Scoring

Weights: CSP 25, HSTS 20, X-Frame-Options 10, X-Content-Type-Options 10, Referrer-Policy 10, Permissions-Policy 10, COOP/CORP/COEP 5 each. Deductions for version leaks, insecure cookies and a missing HTTPS redirect. **A+** requires a score of 95+ with both CSP and HSTS.

### Input

| Field | Default | Description |
|---|---|---|
| `urls` | – | Pages or domains |
| `checkHttpRedirect` | true | Also test `http://` → `https://` |
| `timeoutSecs` | 20 | Per-request timeout |

### Pricing (pay per event)

- **$0.0009 per URL graded.** Unreachable URLs are reported for free.

### Notes

One normal GET request per URL (plus one `http://` request when the redirect check is on). This is a passive header review, not a vulnerability scan — no payloads, no crawling, no personal data.

### Use with AI agents (MCP)

This Actor can be used as a tool by AI agents (Claude, Cursor, VS Code, other MCP clients) through the official [Apify MCP server](https://docs.apify.com/platform/integrations/mcp):

- Add only this Actor as a tool: `https://mcp.apify.com?tools=admirala/http-security-headers-checker` (sign in with OAuth or an Apify API token).
- Or connect `https://mcp.apify.com` and let the agent find it with `search-actors` (e.g. "security headers"), read the input schema with `fetch-actor-details` and run it with `call-actor`.

Example input an agent can pass:

```json
{
  "urls": [
    "https://github.com",
    "http://example.com"
  ]
}
```

Cost per call: $0.0009 per URL graded; unreachable URLs are free. Results come back as dataset items (`get-dataset-items`).

### FAQ

**How do I check a website's security headers?**
Add the URL to `urls`. Each row has `grade`, `score`, the header values, `missing` headers and an `issues` list.

**Is this a vulnerability scanner?**
No. It is a passive review of response headers with one normal GET request (plus one http:// request for the redirect check).

**How is the grade calculated?**
Weighted headers (CSP 25, HSTS 20, ...) minus deductions for version leaks, insecure cookies and a missing HTTPS redirect; A+ needs 95+ with CSP and HSTS.

### Related actors

- [SSL Certificate Checker - Bulk Expiry, Chain & TLS](https://apify.com/admirala/ssl-certificate-expiry-checker)
- [Website Uptime Monitor - Status, Response Time & SSL](https://apify.com/admirala/website-uptime-ssl-monitor)
- Domain Expiry Checker - Bulk WHOIS/RDAP Expiration Dates (coming soon to Apify Store)
- [WHOIS Lookup Bulk - Domain RDAP, DNS Records & SSL](https://apify.com/admirala/domain-whois-rdap-dns-lookup)
- SPF, DKIM & DMARC Checker - Bulk Email Deliverability Audit (coming soon to Apify Store)
- [Tech Stack Detector - BuiltWith & Wappalyzer Alternative](https://apify.com/admirala/website-tech-stack-detector)
- Broken Link Checker - Find 404s & Redirects (Crawl or List) (coming soon to Apify Store)

# Actor input Schema

## `urls` (type: `array`):

Pages or domains to grade; domains without scheme are tried over https://. Example: \["https://github.com", "example.com"]. $0.0009 per URL.

## `checkHttpRedirect` (type: `boolean`):

true = also request the http:// version to check that it redirects to https://.

## `timeoutSecs` (type: `integer`):

Per-request timeout in seconds (3-60).

## Actor input object example

```json
{
  "urls": [
    "https://github.com",
    "http://example.com"
  ],
  "checkHttpRedirect": true,
  "timeoutSecs": 20
}
```

# Actor output Schema

## `results` (type: `string`):

No description

## `summary` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "urls": [
        "https://github.com",
        "http://example.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("admirala/http-security-headers-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "urls": [
        "https://github.com",
        "http://example.com",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("admirala/http-security-headers-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "urls": [
    "https://github.com",
    "http://example.com"
  ]
}' |
apify call admirala/http-security-headers-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,admirala/http-security-headers-checker"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/X6iws0kkgIZVxW2UM/builds/mRZTXlbEbgM3Z8H6l/openapi.json