The Artifact Machine Security Headers Checker

A small artifact for evaluating HTTP security headers on a website — CSP, HSTS, XFO, and more — with per-header grades, a composite security score, and actionable fix guidance.

Use this Actor before a security review, compliance audit, launch, or as a regular crawlability-budget security check. It gives teams a quick answer on which security headers are present, which are misconfigured, and how to fix each gap.

Pulled from The Artifact Machine: generated, tested, and cleaned up by a human.

What It Checks

• Content-Security-Policy — prevents XSS and injection attacks
• Strict-Transport-Security — enforces HTTPS connections
• X-Content-Type-Options — prevents MIME type sniffing
• X-Frame-Options — prevents clickjacking via framing
• Referrer-Policy — controls referrer information leakage
• Permissions-Policy — controls browser feature access (camera, mic, geolocation)
• X-XSS-Protection — legacy XSS filter (deprecated but checked for completeness)
• composite security score (0-100)
• per-header letter grades (A+ to F) with detailed notes
• fix guidance for every missing or weak header

Best For

• security audits and penetration test preparation
• compliance checks (PCI DSS, SOC 2, ISO 27001)
• website launch and migration security reviews
• agency client security diagnostics
• monthly security posture monitoring

Input

{
  "url": "https://example.com"
}

Input Fields

• url: the page URL to check security headers for.

Output

The Actor writes one dataset item and an OUTPUT key-value record with:

• composite security score (0-100) and letter grade
• per-header results with name, value, grade, note, weight
• count of headers by grade (A, B, C, D, F)
• actionable issues with impact and how-to-fix guidance

Example output fields:

• score: 0-100 composite security score
• grade: A-F score band
• headerCounts: header totals by grade band
• headers: per-header detail array (name, value, grade, note, weight, description)
• issues: prioritized fix list with impact and how-to-fix for each missing or weak header

Limits

• This Actor evaluates HTTP security headers only — it does not check SSL certificates, Safe Browsing status, or application-layer vulnerabilities.
• It sends a HEAD request first and falls back to GET if HEAD is blocked.
• Some sites block automated requests differently from regular browsers; results should be reviewed before client delivery.
• The check is point-in-time and does not guarantee ongoing security posture.

Pricing

Use pay-per-event pricing based on completed reports rather than per issue. Suggested starting price: $1.00 to $2.00 per completed security headers report after private runtime cost is measured.