# HTTP Headers Checker - Security Header Audit (`benthepythondev/http-headers-checker`) Actor Check HTTP response headers for websites, including status code, server, cache settings, redirects and common security headers. - **URL**: https://apify.com/benthepythondev/http-headers-checker.md - **Developed by:** [Ben](https://apify.com/benthepythondev) (community) - **Categories:** SEO tools, Automation, Business - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $1.00 / 1,000 results This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## HTTP Headers Checker - Security Header Audit Check HTTP response headers for websites and turn them into a structured dataset. The actor returns status code, final URL, response time, server, content type, cache settings, redirect count, all response headers and a quick audit of common security headers. ### What is the HTTP Headers Checker? HTTP headers describe how a website responds before the browser renders the page. They reveal caching behavior, content type, server hints, redirects, compression, cookies and security policies. For technical SEO, security reviews, uptime checks and migration QA, headers are often the fastest signal that something changed. This actor fetches each target URL, follows redirects, records the final response and normalizes the headers into a clean Apify dataset. It checks for common security headers such as `Strict-Transport-Security`, `Content-Security-Policy`, `X-Frame-Options`, `X-Content-Type-Options`, `Referrer-Policy` and `Permissions-Policy`. It is lightweight, browserless and suitable for scheduled monitoring. ### Common use cases Use this actor to audit security headers across a client portfolio, compare staging and production headers, check whether cache-control changed after a deploy, inspect CDN behavior, verify content types, document redirects, or monitor important landing pages. SEO teams can use it to find unexpected redirects and incorrect content types. Developers can check whether security headers are present after infrastructure changes. Agencies can export header audits for reporting. Data teams can enrich a domain list with response metadata before running deeper crawls. ### Input Provide one or more URLs or domains. ```json { "urls": [ "https://apify.com", "example.com" ] } ```` ### Output Each dataset item represents one checked URL. ```json { "input": "https://apify.com", "url": "https://apify.com", "final_url": "https://apify.com/", "domain": "apify.com", "status_code": 200, "response_time_ms": 320, "headers": { "content-type": "text/html; charset=utf-8" }, "server": "cloudflare", "content_type": "text/html; charset=utf-8", "content_length": "12345", "cache_control": "public, max-age=60", "security_headers_present": { "strict-transport-security": true, "content-security-policy": true }, "security_headers_count": 4, "redirect_count": 0, "error": null } ``` ### Output fields - `input` - the original input. - `url` - normalized URL used by the actor. - `final_url` - final URL after redirects. - `domain` - final response domain. - `status_code` - HTTP status code. - `response_time_ms` - measured response time. - `headers` - all response headers in lowercase keys. - `server`, `content_type`, `content_length`, `cache_control` - commonly inspected fields. - `security_headers_present` - boolean map for common security headers. - `security_headers_count` - quick total of detected security headers. - `redirect_count` - number of redirects followed. - `error` - connection error, if any. ### Why use this actor? Headers are small but important. They can explain caching bugs, indexation problems, security gaps and redirect surprises without crawling a whole website. Apify adds scheduling, exports, webhooks and API access, so the check can become part of a monitoring workflow instead of a manual browser inspection. ### Example workflows Run it weekly across client domains and alert when `security_headers_count` drops. Check a list of landing pages after a CDN migration. Export headers before and after a site launch to prove that cache-control and content-security-policy were preserved. Combine it with a sitemap extractor to audit every important URL from a sitemap. For ecommerce teams, check category, product and checkout URLs separately because CDNs and application servers often apply different headers to each route. For SaaS teams, monitor documentation, app login pages, marketing pages and API docs as separate templates. For publishers, compare article pages and homepage headers to make sure caching does not accidentally serve stale breaking-news pages. ### Integration ideas Send the dataset to a webhook and store only the fields your team cares about, such as `status_code`, `cache_control`, `security_headers_count` and `final_url`. Use Make, Zapier or n8n to notify the responsible person when a header changes. If you already maintain a domain inventory, join it with this actor's output to build a simple technical-health report. You can also run this actor after a sitemap extraction. First gather URLs from a sitemap, then inspect headers across the sampled pages. This catches route-level differences that a homepage-only check would miss. ### Best practices Check both the homepage and important templates such as product pages, blog posts and checkout pages. Security and caching headers can vary by route. Watch final URLs and redirect counts during migrations. If a site blocks `HEAD`, the actor falls back to `GET`, but some protected sites may still behave differently for automated traffic. Review missing headers in context. Not every website needs the same policy, but the absence of HSTS, CSP or frame protections is worth discussing during a security or SEO audit. Treat the actor as a scalable inspection layer, then decide policy with your engineering or security team. ### Data quality notes Header names are normalized to lowercase to make filtering and joins easier. The full header dictionary is preserved, so you can inspect custom CDN, proxy and application headers beyond the summary fields. Response time is measured from the actor runtime and should be used as a directional signal, not a replacement for global performance monitoring. ### FAQ Does it use a browser? No. It uses direct HTTP requests, which keeps runs fast and low-cost. Can it detect missing security headers? Yes. The `security_headers_present` map shows which common headers are present. Can I run it on a schedule? Yes. Schedule it daily or weekly and compare results to catch changes. Does it crawl links? No. It checks only the URLs you provide. ### You might also like - Website Status Checker - monitor status codes and page titles. - Robots Sitemap Analyzer - inspect robots files and sitemap links. - URL Shortener Expander - inspect redirect chains. ### Keywords HTTP headers checker, security headers audit, header API, cache-control checker, HSTS checker, CSP checker, website header scraper, SEO technical audit, Apify headers checker. # Actor input Schema ## `urls` (type: `array`): Websites or URLs to inspect. ## Actor input object example ```json { "urls": [ "https://apify.com" ] } ``` # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "urls": [ "https://apify.com" ] }; // Run the Actor and wait for it to finish const run = await client.actor("benthepythondev/http-headers-checker").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "urls": ["https://apify.com"] } # Run the Actor and wait for it to finish run = client.actor("benthepythondev/http-headers-checker").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "urls": [ "https://apify.com" ] }' | apify call benthepythondev/http-headers-checker --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=benthepythondev/http-headers-checker", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "HTTP Headers Checker - Security Header Audit", "description": "Check HTTP response headers for websites, including status code, server, cache settings, redirects and common security headers.", "version": "1.0", "x-build-id": "6EwCAUyFUKNSOkYZm" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/benthepythondev~http-headers-checker/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-benthepythondev-http-headers-checker", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/benthepythondev~http-headers-checker/runs": { "post": { "operationId": "runs-sync-benthepythondev-http-headers-checker", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/benthepythondev~http-headers-checker/run-sync": { "post": { "operationId": "run-sync-benthepythondev-http-headers-checker", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "urls": { "title": "URLs", "type": "array", "description": "Websites or URLs to inspect.", "default": [ "https://apify.com" ], "items": { "type": "string" } } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```