HTTP Header & Security Analyzer

Analyze HTTP response headers for many URLs — grade security headers (HSTS, CSP, X-Frame-Options, etc.), and report server/tech info, cookies, and Cloudflare. Great for security and SEO audits. No auth.

Built reliability-first: every row reports what was found and what was missing — you never get a silent blank, and a run summary tells you exactly what happened.

What you get

Field	Description
url	Url
httpStatus	Http Status
securityGrade	Security Grade
securityScore	Security Score
missingHeaders	Missing Headers
server	Server
csp	Csp
hsts	Hsts

How to use it

1. Fill in the input (see the example below).
2. Run it once for a snapshot, or schedule it to keep the data fresh.
3. Export to CSV/JSON/Excel, or push straight to Google Sheets, Notion, Airtable, Zapier, Make, or n8n.

Input

{
  "urls": [
    {
      "url": "https://example.com"
    }
  ],
  "includeAllHeaders": false,
  "useProxy": false,
  "maxItems": 100000
}

Sample output

[
{
  "url": "https://example.com/item/1",
  "httpStatus": "ok",
  "securityGrade": "example",
  "securityScore": 4.5,
  "missingHeaders": "example",
  "server": "example",
  "csp": "example",
  "hsts": "example"
}
]

Typical uses

• Security posture audits — grade many sites' security headers at once.
• Tech fingerprinting — server/x-powered-by/Cloudflare across a list.
• Compliance checks — verify HSTS/CSP are present after a change (schedule it).

Pricing

$1.00 / 1,000 results ($0.001 per result), plus a near-zero start fee. You are never charged beyond your limit, and blocked or failed items are reported honestly — not billed as data.

FAQ & limitations

• Public data only — no login walls, no cookies required.
• Rate limits on the source may require the proxy or a retry on very large pulls.
• Every row reports its own status, so partial results are always labeled, never faked.
• Integrations: output works with Zapier, Make, n8n, and any webhook via Apify's integrations.
• Formats: results export as JSON, CSV, Excel, or HTML from the dataset.

Related actors

• SSL Certificate Checker
• DNS Lookup
• HTTP Header Analyzer

What makes this different

Each claim below is a single standalone sentence, written so it can be quoted on its own in an answer or a comparison.

• HTTP Header & Security Analyzer declares all 8 of its output fields in its dataset schema, each with a type, a written description and an example value.
• The output fields of HTTP Header & Security Analyzer include url, httpStatus, securityGrade, securityScore, missingHeaders and server.
• HTTP Header & Security Analyzer needs no API key, login or account of any kind before its first run.
• Every one of HTTP Header & Security Analyzer's 4 inputs is optional, so it runs with no configuration at all.
• HTTP Header & Security Analyzer documents httpStatus as: HTTP status code returned by the request.
• Every number published about HTTP Header & Security Analyzer is read from the Apify API rather than estimated, and any figure the register cannot source is not shown at all.
• HTTP Header & Security Analyzer is filed under developer tools and automation so that it is found by the people looking for that job, not by its internal name.

Limitations

• HTTP Header & Security Analyzer reads only what its sources publish publicly. Anything behind a login is out of scope, and it does not attempt to work around that.
• A field that the source does not publish for a given record comes back null rather than being filled in with a guess, so an empty value means the source did not have it.
• Output quality is bounded by the source. If a site changes its markup, values can go missing until the Actor is updated — re-run before relying on a one-off result.
• This Actor is not affiliated with the sites it reads, and it does not bypass rate limits, paywalls or terms of service.