# HTTP Security Headers Checker (`autoloom/http-security-headers-checker`) Actor

Check a list of URLs for HTTP security headers (HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP). Grades each site, flags weak values (not just missing ones), and gives a copy-paste header block to fix it.

- **URL**: https://apify.com/autoloom/http-security-headers-checker.md
- **Developed by:** [Autoloom](https://apify.com/autoloom) (community)
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.50 / 1,000 results

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## HTTP Security Headers Checker

**HTTP Security Headers Checker** is a bulk HTTP header checker for security. For any list of URLs it reads the response headers, scores them **0–100 with an A–F grade**, lists every problem in plain English, and gives you a **copy-paste block of the headers to add**. It flags weak values as well as missing ones, so a short-lived HSTS or a CSP that relies on `unsafe-inline` is caught.

> **Pricing:** pay per result: $1.50 per 1,000 results ($0.15 per 100, $15.00 per 10,000), plus $0.00005 per run start. One result = one URL checked.

### What data you get (one row per URL)

| Field | What it is |
|---|---|
| `url`, `statusCode` | The page and its HTTP status |
| `headers` | The value of each security header checked (empty if missing) |
| `score`, `grade` | 0–100 score and A–F grade |
| `issues`, `issueCount` | Plain-English problems, e.g. "HSTS missing includeSubDomains" |
| `missing` | The headers that are absent |
| `recommendedBlock` | Ready-to-paste header lines for the missing headers |

### How the score works

| Header | Points | What is checked |
|---|---|---|
| Strict-Transport-Security (HSTS) | up to 20 | Present; `max-age` of at least 15,768,000 seconds (6 months); `includeSubDomains` |
| Content-Security-Policy | up to 25 | Present; flagged as weak if it uses `unsafe-inline` or `unsafe-eval` |
| X-Content-Type-Options | 10 | Set to `nosniff` |
| X-Frame-Options or CSP `frame-ancestors` | 12 | Clickjacking protection |
| Referrer-Policy | 10 | Present |
| Permissions-Policy | 10 | Present |
| Cross-Origin-Opener-Policy | 7 | Present |
| Cross-Origin-Embedder-Policy / Cross-Origin-Resource-Policy | 3 each | Present |

Grades: A 90+, B 80+, C 65+, D 50+, E 30+, F below 30.

### How to use it

1. Paste your URLs into **URLs to check** (one per line, or upload a list).
2. Click **Start**.
3. Sort by `score`, then hand each site's `recommendedBlock` to whoever manages the server or CDN.

### Input example

```json
{
  "startUrls": [
    { "url": "https://apify.com" },
    { "url": "https://example.com" }
  ]
}
```

### Output example

A real row from a test run on `https://apify.com` (14 Oct 2026), with the long CSP value shortened:

```json
{
  "url": "https://apify.com",
  "statusCode": 200,
  "headers": {
    "strict-transport-security": "max-age=15768000",
    "content-security-policy": "default-src 'none'; connect-src 'self' data: https://apify.com …",
    "x-content-type-options": "nosniff",
    "x-frame-options": "SAMEORIGIN",
    "referrer-policy": "",
    "permissions-policy": "",
    "cross-origin-opener-policy": "",
    "cross-origin-embedder-policy": "",
    "cross-origin-resource-policy": ""
  },
  "score": 50,
  "grade": "D",
  "issues": [
    "HSTS missing includeSubDomains",
    "CSP weakened by 'unsafe-inline'/'unsafe-eval'",
    "Missing Referrer-Policy",
    "Missing Permissions-Policy",
    "Missing Cross-Origin-Opener-Policy"
  ],
  "issueCount": 5,
  "missing": ["referrer-policy", "permissions-policy", "cross-origin-opener-policy"],
  "recommendedBlock": "Referrer-Policy: strict-origin-when-cross-origin\nPermissions-Policy: geolocation=(), camera=(), microphone=()\nCross-Origin-Opener-Policy: same-origin"
}
```

### Pricing

| URLs checked | Cost |
|---|---|
| 100 | $0.15 |
| 1,000 | $1.50 |
| 10,000 | $15.00 |

One result per URL, plus $0.00005 per run start. Apify's free plan includes monthly platform credit you can use to try it, and free-plan users get the same features.

### Use it with the API, Make, Zapier or Google Sheets

```bash
curl -X POST "https://api.apify.com/v2/acts/autoloom~http-security-headers-checker/run-sync-get-dataset-items?token=YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"startUrls":[{"url":"https://apify.com"}]}'
```

Send results to Google Sheets, Make, Zapier or n8n through Apify's integrations, or schedule a monthly run to catch headers lost after a deploy or CDN change.

### FAQ

**Is this a full security scan?** No. It checks the HTTP response headers listed above, which are quick wins for browser-side protection. It does not test for vulnerabilities in the site itself.

**Should I paste the recommended block exactly?** The block is a safe starting point for the missing headers. A Content-Security-Policy in particular has to be written for each site, so test any change on staging first.

**Which page is checked?** The exact URL you give. Different paths can send different headers, so add the key pages (home, login, checkout) separately.

**What about sites that block bots?** You still get a row with the status code, so you can see which URLs could not be read.

**Is it legal?** It sends one normal request per URL and reads the public response headers, the same as a browser. Only check sites you have the right to access.

### Related tools from autoloom

- [Redirect Checker & Redirect Chain Tracer](https://apify.com/autoloom/redirect-tracer): confirms HTTP upgrades to HTTPS cleanly
- [Website Technology & Tech Stack Detector](https://apify.com/autoloom/website-technology-detector): shows the CDN, server and framework behind each site
- [Broken Link Checker](https://apify.com/autoloom/broken-link-checker): finds 404s and dead links

***

Built by **autoloom**: small, fast web-data and SEO tools.

# Actor input Schema

## `startUrls` (type: `array`):

The URLs whose security headers you want to check.

## Actor input object example

```json
{
  "startUrls": [
    {
      "url": "https://apify.com"
    }
  ]
}
```

# Actor output Schema

## `dataset` (type: `string`):

One row per URL: each security header's value, a score and grade, the issues found, and a copy-paste block of the headers to add.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "startUrls": [
        {
            "url": "https://apify.com"
        }
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("autoloom/http-security-headers-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "startUrls": [{ "url": "https://apify.com" }] }

# Run the Actor and wait for it to finish
run = client.actor("autoloom/http-security-headers-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "startUrls": [
    {
      "url": "https://apify.com"
    }
  ]
}' |
apify call autoloom/http-security-headers-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,autoloom/http-security-headers-checker"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/jXoFbhoY7BAO05sDH/builds/6tIA7kWBDRKIxGtTX/openapi.json