# Security Headers Bulk QA (`checksmithcats/security-headers-bulk-qa`) Actor Bulk-check public URLs for scanner-visible HTTP response header signals before launch, migration, or template changes. - **URL**: https://apify.com/checksmithcats/security-headers-bulk-qa.md - **Developed by:** [Checksmith Cats](https://apify.com/checksmithcats) (community) - **Categories:** Developer tools, Automation - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing from $0.25 / report generated This Actor is paid per event and usage. You are charged both the fixed price for specific events and for Apify platform usage. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js/docs.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python/docs.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Security Headers Bulk QA Bulk-check public pages for scanner-visible HTTP response header signals. This Actor is for teams that publish many public pages and need a quick evidence report before a launch, migration, CMS template change, or release review. It reads public URLs, follows the normal fetch path, and reports what the scanner can observe in the final HTTP response headers. ### What it checks - Input from `urls`, `sitemapUrl`, or public `csvUrl` - Fetch status for every sampled URL - Final URL scheme and HTTP-to-HTTPS redirect behavior - `Strict-Transport-Security` presence and parseable `max-age` - `Content-Security-Policy` presence and selected high-risk policy signals - `X-Content-Type-Options: nosniff` - `X-Frame-Options` or CSP `frame-ancestors` - `Referrer-Policy` - `Permissions-Policy` - `Cross-Origin-Opener-Policy` - `Cross-Origin-Embedder-Policy` - `Cross-Origin-Resource-Policy` - Legacy or information-revealing headers such as `X-XSS-Protection`, `X-Powered-By`, and `Server` - Bulk patterns where common headers are absent on most sampled pages ### Findings Each finding includes: - `severity` - `confidence` - `evidence` - `caveat` - source URL with query strings redacted - source references where applicable Primary finding families include: - `transport.*` - `hsts.*` - `csp.*` - `x_content_type_options.*` - `x_frame_options.*` - `framing.*` - `referrer_policy.*` - `permissions_policy.*` - `coop.*` - `coep.*` - `corp.*` - `legacy.*` - `leakage.*` - `bulk.*` ### Boundaries This is an informational diagnostic tool for public HTTP responses. It is not a vulnerability scan, penetration test, compliance assessment, managed security service, CSP design service, incident-prevention service, or guarantee that a site is safe, secure, or protected from incidents. The scanner does not log in, does not bypass robots.txt, does not test private networks, does not exploit behavior, does not render JavaScript, and does not validate whether a policy is correct for a specific application. CSP findings are limited to static header shape and selected visible signals. ### Billing note Pay-per-event billing is based on reachable URLs only. Unreachable pages are reported as findings, but they are not counted as checked URLs. ### References - OWASP HTTP Headers Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html - MDN Strict-Transport-Security: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Strict-Transport-Security - MDN Content-Security-Policy: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy - MDN X-Content-Type-Options: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Content-Type-Options - MDN X-Frame-Options: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options - MDN Referrer-Policy: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Referrer-Policy - MDN Permissions-Policy: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy - MDN Cross-Origin-Opener-Policy: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Opener-Policy - MDN Cross-Origin-Embedder-Policy: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Embedder-Policy - MDN Cross-Origin-Resource-Policy: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Resource-Policy ### Related tools - Checksmith CI - Use before deploy when the relevant public files are still in the repository. - Site Migration Redirect QA - Use when launch checks also need redirect-chain and final URL review. - Policy Page Drift Pack - Use when policy pages should be watched after headers are checked. # Actor input Schema ## `urls` (type: `array`): Public page URLs to check. ## `sitemapUrl` (type: `string`): Optional public sitemap URL containing pages to sample. ## `csvUrl` (type: `string`): Optional public CSV URL with a URL column such as url, pageUrl, link, href, loc, or canonical. ## `sampleLimit` (type: `integer`): Maximum number of extracted URLs to inspect. ## Actor input object example ```json { "urls": [ "https://example.com/", "https://example.com/pricing" ], "sampleLimit": 25 } ```` # Actor output Schema ## `results` (type: `string`): No description ## `report` (type: `string`): No description # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "urls": [ "https://example.com/", "https://example.com/pricing" ] }; // Run the Actor and wait for it to finish const run = await client.actor("checksmithcats/security-headers-bulk-qa").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "urls": [ "https://example.com/", "https://example.com/pricing", ] } # Run the Actor and wait for it to finish run = client.actor("checksmithcats/security-headers-bulk-qa").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "urls": [ "https://example.com/", "https://example.com/pricing" ] }' | apify call checksmithcats/security-headers-bulk-qa --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=checksmithcats/security-headers-bulk-qa", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Security Headers Bulk QA", "description": "Bulk-check public URLs for scanner-visible HTTP response header signals before launch, migration, or template changes.", "version": "0.1", "x-build-id": "x8i64ettJLqKInNQT" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/checksmithcats~security-headers-bulk-qa/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-checksmithcats-security-headers-bulk-qa", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/checksmithcats~security-headers-bulk-qa/runs": { "post": { "operationId": "runs-sync-checksmithcats-security-headers-bulk-qa", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/checksmithcats~security-headers-bulk-qa/run-sync": { "post": { "operationId": "run-sync-checksmithcats-security-headers-bulk-qa", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "urls": { "title": "Page URLs", "type": "array", "description": "Public page URLs to check.", "items": { "type": "string", "pattern": "^https?:\\/\\/.+" } }, "sitemapUrl": { "title": "Sitemap URL", "pattern": "^https?:\\/\\/.+", "type": "string", "description": "Optional public sitemap URL containing pages to sample." }, "csvUrl": { "title": "CSV URL", "pattern": "^https?:\\/\\/.+", "type": "string", "description": "Optional public CSV URL with a URL column such as url, pageUrl, link, href, loc, or canonical." }, "sampleLimit": { "title": "Sample limit", "minimum": 1, "maximum": 500, "type": "integer", "description": "Maximum number of extracted URLs to inspect.", "default": 25 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```