HTTP Security Headers Checker

HTTP Security Headers Checker is a bulk HTTP header checker for security. For any list of URLs it reads the response headers, scores them 0–100 with an A–F grade, lists every problem in plain English, and gives you a copy-paste block of the headers to add. It flags weak values as well as missing ones, so a short-lived HSTS or a CSP that relies on unsafe-inline is caught.

Pricing: pay per result: $1.50 per 1,000 results ($0.15 per 100, $15.00 per 10,000), plus $0.00005 per run start. One result = one URL checked.

What data you get (one row per URL)

Field	What it is
url, statusCode	The page and its HTTP status
headers	The value of each security header checked (empty if missing)
score, grade	0–100 score and A–F grade
issues, issueCount	Plain-English problems, e.g. "HSTS missing includeSubDomains"
missing	The headers that are absent
recommendedBlock	Ready-to-paste header lines for the missing headers

How the score works

Header	Points	What is checked
Strict-Transport-Security (HSTS)	up to 20	Present; max-age of at least 15,768,000 seconds (6 months); includeSubDomains
Content-Security-Policy	up to 25	Present; flagged as weak if it uses unsafe-inline or unsafe-eval
X-Content-Type-Options	10	Set to nosniff
X-Frame-Options or CSP frame-ancestors	12	Clickjacking protection
Referrer-Policy	10	Present
Permissions-Policy	10	Present
Cross-Origin-Opener-Policy	7	Present
Cross-Origin-Embedder-Policy / Cross-Origin-Resource-Policy	3 each	Present

Grades: A 90+, B 80+, C 65+, D 50+, E 30+, F below 30.

How to use it

1. Paste your URLs into URLs to check (one per line, or upload a list).
2. Click Start.
3. Sort by score, then hand each site's recommendedBlock to whoever manages the server or CDN.

Input example

{
  "startUrls": [
    { "url": "https://apify.com" },
    { "url": "https://example.com" }
  ]
}

Output example

A real row from a test run on https://apify.com (14 Oct 2026), with the long CSP value shortened:

{
  "url": "https://apify.com",
  "statusCode": 200,
  "headers": {
    "strict-transport-security": "max-age=15768000",
    "content-security-policy": "default-src 'none'; connect-src 'self' data: https://apify.com …",
    "x-content-type-options": "nosniff",
    "x-frame-options": "SAMEORIGIN",
    "referrer-policy": "",
    "permissions-policy": "",
    "cross-origin-opener-policy": "",
    "cross-origin-embedder-policy": "",
    "cross-origin-resource-policy": ""
  },
  "score": 50,
  "grade": "D",
  "issues": [
    "HSTS missing includeSubDomains",
    "CSP weakened by 'unsafe-inline'/'unsafe-eval'",
    "Missing Referrer-Policy",
    "Missing Permissions-Policy",
    "Missing Cross-Origin-Opener-Policy"
  ],
  "issueCount": 5,
  "missing": ["referrer-policy", "permissions-policy", "cross-origin-opener-policy"],
  "recommendedBlock": "Referrer-Policy: strict-origin-when-cross-origin\nPermissions-Policy: geolocation=(), camera=(), microphone=()\nCross-Origin-Opener-Policy: same-origin"
}

Pricing

URLs checked	Cost
100	$0.15
1,000	$1.50
10,000	$15.00

One result per URL, plus $0.00005 per run start. Apify's free plan includes monthly platform credit you can use to try it, and free-plan users get the same features.

Use it with the API, Make, Zapier or Google Sheets

curl -X POST "https://api.apify.com/v2/acts/autoloom~http-security-headers-checker/run-sync-get-dataset-items?token=YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"startUrls":[{"url":"https://apify.com"}]}'

Send results to Google Sheets, Make, Zapier or n8n through Apify's integrations, or schedule a monthly run to catch headers lost after a deploy or CDN change.

FAQ

Is this a full security scan? No. It checks the HTTP response headers listed above, which are quick wins for browser-side protection. It does not test for vulnerabilities in the site itself.

Should I paste the recommended block exactly? The block is a safe starting point for the missing headers. A Content-Security-Policy in particular has to be written for each site, so test any change on staging first.

Which page is checked? The exact URL you give. Different paths can send different headers, so add the key pages (home, login, checkout) separately.

What about sites that block bots? You still get a row with the status code, so you can see which URLs could not be read.

Is it legal? It sends one normal request per URL and reads the public response headers, the same as a browser. Only check sites you have the right to access.

Related tools from autoloom

• Redirect Checker & Redirect Chain Tracer: confirms HTTP upgrades to HTTPS cleanly
• Website Technology & Tech Stack Detector: shows the CDN, server and framework behind each site
• Broken Link Checker: finds 404s and dead links

---

Built by autoloom: small, fast web-data and SEO tools.