Bulk URL Status Checker: Redirects, SSL Expiry, Metadata

Bulk URL Status Checker checks thousands of URLs and returns, for each one: the final HTTP status code, the full redirect chain (every hop with its status and Location), redirect loops, response time, content type and server, plus the SSL certificate of the host: issuer, expiry date, days until expiry, and whether it's trusted and valid for that host name. Optionally it also reports security headers (HSTS, CSP and four more, with a score out of 6) and page metadata: title, meta description, canonical, robots meta, lang, first H1, Open Graph and Twitter card tags, favicon and JSON-LD types. Paste URLs, or point it at any Apify dataset of links and the columns are added next to each item.

Why this Actor

• Every redirect hop is recorded. Redirects are followed one by one, so you see http → https → www → final page, with the status code of each hop, not just where it ended. Loops and over-long chains are flagged instead of hanging.
• Dead links are reported, not dropped. DNS failures, timeouts, refused connections and TLS errors each get a plain-English error and a row of their own.
• One certificate check per host. 5,000 URLs on one site need one certificate check for the SSL columns; the result is reused.
• Polite. At most 2 requests at a time to any one host by default, a few retries with backoff on 429/502/503/504 (honouring Retry-After), and a User-Agent that names the tool.
• Guards against risky link lists. Every host is resolved first and private, loopback, link-local, multicast, reserved and cloud-metadata addresses are refused, on the first URL and on every redirect hop.

Use cases

• SEO audits: find 404s, redirect chains longer than one hop, redirect loops, and pages whose canonical or robots meta isn't what you expect.
• Site migrations: feed in the old URLs and check that each one 301s to the right new page (finalUrl, redirectChain).
• Cleaning scraped link lists: check every website a scraper collected and keep only the ones that answer 2xx.
• SSL expiry monitoring: schedule a weekly run over your domains and alert on sslDaysUntilExpiry below 21 or sslValid: false.
• Security header review: see which of your sites are missing HSTS, CSP or X-Frame-Options.
• Link previews: collect title, description and og:image for a list of URLs.

How to use it

1. Add URLs (full URLs or bare domains such as example.com, which become https://example.com/), and/or pick a Dataset to enrich. For datasets, set URL fields if yours aren't named url, website or link.
2. Choose what to check. SSL is on by default; turn on security headers or page metadata if you need them.
3. Run it. Each URL becomes one output row. Export as CSV, Excel or JSON, or chain it with an integration.

Input example

{
  "urls": ["https://apify.com", "http://wikipedia.org", "example.com/old-page"],
  "method": "auto",
  "followRedirects": true,
  "maxRedirects": 10,
  "timeoutSecs": 15,
  "checkSsl": true,
  "checkSecurityHeaders": true,
  "extractMetadata": true
}

Output example (shortened; values are illustrative)

{
  "inputUrl": "http://wikipedia.org",
  "url": "http://wikipedia.org/",
  "finalUrl": "https://www.wikipedia.org/",
  "statusCode": 200,
  "ok": true,
  "statusText": "OK",
  "redirectCount": 2,
  "redirectChain": [
    {"url": "http://wikipedia.org/", "statusCode": 301, "location": "https://wikipedia.org/"},
    {"url": "https://wikipedia.org/", "statusCode": 301, "location": "https://www.wikipedia.org/"}
  ],
  "isRedirectLoop": false,
  "method": "GET",
  "responseTimeMs": 182,
  "contentType": "text/html",
  "contentLength": 98213,
  "server": "ATS/9.2.11",
  "lastModified": "2026-10-14T09:12:40Z",
  "ipAddress": "185.15.59.224",
  "sslIssuer": "DigiCert Inc",
  "sslIssuerCommonName": "DigiCert TLS Hybrid ECC SHA384 2020 CA1",
  "sslSubject": "*.wikipedia.org",
  "sslExpiresAt": "2027-03-12T23:59:59Z",
  "sslDaysUntilExpiry": 148,
  "sslValidForHost": true,
  "sslValid": true,
  "sslError": null,
  "securityHeadersScore": "3/6",
  "securityHeadersMissing": ["content-security-policy", "referrer-policy", "permissions-policy"],
  "title": "Wikipedia",
  "metaDescription": "Wikipedia is a free online encyclopedia…",
  "canonical": null,
  "lang": "en",
  "ogImage": "https://www.wikipedia.org/portal/wikipedia.org/assets/img/Wikipedia-logo-v2.png",
  "jsonLdTypes": [],
  "error": null,
  "checkedAt": "2026-10-15T10:31:07Z"
}

All columns

• Request: inputUrl, url (normalised), finalUrl, statusCode (of the final response), ok (2xx), statusText, redirectCount, redirectChain ([{url, statusCode, location}]), isRedirectLoop, redirectLocation (only when Follow redirects is off and the answer is a redirect), method (HEAD or GET, whichever gave the final answer), responseTimeMs, contentType, contentLength, server, lastModified, ipAddress, error, checkedAt.
• SSL (https only): sslIssuer (organisation, or common name if there's none), sslIssuerCommonName, sslSubject, sslSans, sslValidFrom, sslExpiresAt, sslDaysUntilExpiry, sslValidForHost, sslValid, sslError.
• Security headers (when on): hsts, contentSecurityPolicy, xFrameOptions, xContentTypeOptions, referrerPolicy, permissionsPolicy (the header value, or null if missing), securityHeadersPresent, securityHeadersScore ("x/6"), securityHeadersMissing.
• Metadata (when on): title, metaDescription, canonical, robotsMeta, lang, h1, ogTitle, ogDescription, ogImage, ogType, twitterCard, favicon, jsonLdTypes. Relative links are made absolute.

error values include DNS lookup failed, Timed out, Connection refused, TLS error: <reason>, Redirect loop, Too many redirects (more than N), Blocked: private address and Invalid URL: <reason>. A run summary (counts of 2xx, 4xx, 5xx, unreachable, invalid SSL, certificates expiring within 30 days…; the 30-day summary count is fixed, while your own alerts can use any threshold, such as the 21 days in the use case above) is saved as OUTPUT in the key-value store.

How much does it cost?

Pay per event: $0.0025 per checked URL (one output row), plus $0.005 per run start. Apify platform usage is included.

Apify Store discounts: the price above is for Apify's Free plan. Paid plans pay less per 1,000 checked URLs: $2.18 on Starter, $1.75 on Scale, $1.38 on Business. The "from" price at the top of the Store page is the Business price.

A dead link is a result, so URLs that return 404 or 500, or fail with a DNS error, timeout or refused connection, are charged. These are free: rows for input that isn't a valid http(s) URL, URLs refused by the private-address guard, and repeats skipped by Check each URL once.

Worked examples:

Examples use the Free-plan rate. Where an example doesn't add it, each run also has its run-start charge, counted per GB of Actor memory (minimum one; one at the default memory); Apify Proxy (where used) is billed separately.

• 1,000 URLs: 1,000 × $0.0025 + $0.005 = $2.505.
• A weekly SSL and status check of 100 URLs: $0.255 per run, about $1.10 per month.

If you set a maximum cost per run, the Actor stops cleanly at that limit. If a run is restarted (for example after a timeout or migration), it continues after the rows already in its dataset.

FAQ and limits

Does it render JavaScript?

No. It makes plain HTTP requests, so JavaScript redirects, <meta http-equiv="refresh"> redirects and "soft 404s" (an error page served with status 200) aren't detected, and metadata is what the server's HTML contains before any script runs.

A site returns 403 or 429 but works in my browser.

Some sites block automated requests or requests from data-centre IP addresses (Cloudflare and similar bot protection). The Actor doesn't use proxies or solve challenges, so it reports the status it actually got. You can set a different User-Agent, but that won't get past bot protection.

What does "auto" method do?

It sends HEAD first (fast, no body). If the server answers HEAD with 403, 405 or 501, or drops the connection, it retries that URL with GET. Turning on page metadata uses GET for every request, because the HTML is needed.

Why is a URL with a bad certificate shown with no status code?

The HTTP request verifies the certificate like a browser does, so an expired, self-signed or untrusted certificate gives error: "TLS error: …". The SSL columns still show the certificate details and the reason in sslError. Trust is checked against Mozilla's CA list (certifi). For URLs that end on plain http, the last https URL in the chain is the one whose certificate is checked.

Can I check internal or localhost URLs?

No. Private, loopback, link-local and cloud-metadata addresses are always refused (free rows with Blocked: private address), including when a public URL redirects to one.

Other limits

• Page metadata reads at most 2 MB of HTML per page; favicon is the icon the page declares (it isn't fetched or verified).
• Cookies are kept within one URL's redirect chain only (some sites set a cookie and redirect), never shared between URLs.
• Each request (each redirect hop) waits at most Timeout per request; a whole URL, with all its hops, retries and the HEAD→GET fallback, gets at most 4× that (at least 60 seconds) before it's reported as Timed out. Retry-After waits are capped at 10 seconds.
• Page metadata asks for gzip or deflate only; a page sent with another compression (such as Brotli) gets empty metadata columns.
• HTTP/1.1 only. Response times are measured from Apify's servers, not your location.

Other tools by the same author

Actor	Use it to
HTTP Request & API Calls	Call an API for each URL (GET or POST, headers, JSON body) and keep the full JSON response.
PageSpeed & Lighthouse Audit	Get Lighthouse scores and Core Web Vitals for the URLs that load.
Sitemap URL Extractor & New Page Monitor	Get the full URL list of a site from its sitemaps, then check them all here.
Domain WHOIS & DNS Lookup	Check domain registration and expiry dates next to SSL expiry.
Merge & Deduplicate Datasets	Keep only links you haven't checked before, between runs.
Notify Step	Email or Slack a report when a scheduled check finds broken links or expiring certificates.
Google Sheets Import & Export	Send the results to a Google Sheet.
Dataset Delivery	Deliver the results as CSV or Excel to SFTP, Dropbox or Google Drive.
Broken Link Checker	Crawl a whole website and find every broken link (404s, dead external links, redirects) with the page it's on.
Website Tech Stack Detector	Detect the platform, CMS and tags behind each live URL.