Security Headers Checker: Bulk HTTP Header Scan & A-F Grade

For AI agents: Use when asked to check a website's security headers, HTTP headers, HSTS, Content-Security-Policy, clickjacking protection, cookie flags or HTTP to HTTPS redirect, or to grade site security. Call with urls (URLs or domains; required), optional outputFilter (all, problems, below-grade) and gradeThreshold. Returns one row per URL: grade (A-F), score (0-100), finalUrl, missingHeaders, problems, recommendations, checks (per header), headers, cookies, httpToHttps, tlsValid, techDisclosure, securityTxt. Cost: $0.001 per URL ($1 per 1,000); unreachable URLs and invalid inputs free.

For people: Tell your AI agent "check the security headers of our 40 client websites and list the ones graded C or worse with what to fix" and it hands the list to this tool, then reads back a clean table. No browser extensions, no one-site-at-a-time scanners, and 1,000 URLs cost $1.

Bulk security headers checker for hundreds or thousands of websites in one run. Paste a list of URLs or domains and this HTTP header scanner fetches each page like a browser, follows the redirect chain, and grades the final response's security headers: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP) with unsafe-inline / unsafe-eval / wildcard detection, X-Frame-Options or CSP frame-ancestors (clickjacking), X-Content-Type-Options, Referrer-Policy and Permissions-Policy. It also checks that http:// redirects to https://, that cookies have Secure / HttpOnly / SameSite, that the TLS certificate is valid, that the server doesn't disclose its software version (Server, X-Powered-By, X-AspNet-Version) and whether a security.txt is published. Every URL gets an A-F grade, a 0-100 score and a plain-English problems list with the fix.

No proxies, no API keys and no browser: results export to CSV, Excel, JSON or Google Sheets or run on a schedule as a security header monitor for your sites or your clients'.

What does this security headers checker do?

• 🛡️ Six key security headers graded with the details that matter: HSTS max-age (180 days minimum), includeSubDomains and preload; CSP that doesn't restrict scripts, allows 'unsafe-inline' without a nonce or hash, 'unsafe-eval' or * / https: script sources, or is Report-Only; obsolete ALLOW-FROM; unsafe Referrer-Policy values; deprecated Feature-Policy.
• 🔀 Redirects: the full redirect chain (every hop with status code, location and timing), the HTTP to HTTPS redirect of the plain-http version, HTTPS-to-HTTP downgrades, redirect loops.
• 🍪 Cookie flags for every Set-Cookie along the chain: missing Secure, session-like cookies without HttpOnly, missing or invalid SameSite.
• 🔐 TLS certificate validity (expired, self-signed, wrong host and untrusted certificates are flagged and graded F, while the headers are still read).
• 🕵️ Information disclosure: Server: nginx/1.18.0, X-Powered-By: PHP/8.1, X-AspNet-Version and similar version leaks.
• 📄 security.txt (RFC 9116): contacts and expiry date, expired files flagged.
• 🅰️ A-F grade and 0-100 score per URL, missingHeaders, problems (scored) and recommendations (optional hardening such as COOP, SameSite, deprecated X-XSS-Protection), plus the raw header values.
• 🧹 Bulk-friendly input: full URLs, bare domains (example.com -> https://example.com/) or emails, de-duplicated; up to 50 checks in parallel, at most 4 per host.

How the grade is calculated

Check	Points
Strict-Transport-Security (max-age >= 180 days)	20
Content-Security-Policy that restricts scripts safely	20
Clickjacking protection (X-Frame-Options or CSP frame-ancestors)	15
X-Content-Type-Options: nosniff	10
Referrer-Policy (safe value)	10
HTTP redirects to HTTPS	10
Permissions-Policy	5
Cookies with Secure (+ HttpOnly on session cookies)	5
No server version disclosure	5

A 90-100, B 75-89, C 60-74, D 45-59, F below 45. A page that ends on plain HTTP or has an invalid TLS certificate is always F.

Use cases

• Website security audits for agencies, MSPs and freelancers: grade every client site in one run and hand over a fix list.
• Security header monitoring: schedule a weekly run with Only URLs graded below the threshold and get alerted when a deploy drops HSTS or CSP.
• Vendor and third-party risk: check the public sites of suppliers, SaaS vendors or acquisition targets for basic hygiene.
• Lead generation for security services: find prospects with missing headers, plain HTTP or outdated server software.
• Pentest and bug bounty recon: map CSP weaknesses, cookie flags, version leaks and security.txt contacts across many hosts.
• Compliance evidence (SOC 2, ISO 27001, PCI DSS, OWASP ASVS): export a dated CSV of headers for every public endpoint.

How to use it

1. Paste URLs or domains into URLs or domains, one per line.
2. Optionally choose Which URLs to save (all, only problems, only below a grade) and keep the HTTP-to-HTTPS and security.txt checks on.
3. Click Start, then open the Overview table or export the results. For monitoring, add a Schedule plus an email, Slack or webhook integration in Apify Console.

Input example

{
  "urls": ["apify.com", "https://github.com/login", "example.com"],
  "checkHttpRedirect": true,
  "checkSecurityTxt": true,
  "outputFilter": "all"
}

Output example

{
  "url": "https://example.com/",
  "status": "ok",
  "grade": "F",
  "score": 30,
  "finalUrl": "https://example.com/",
  "finalStatusCode": 200,
  "https": true,
  "tlsValid": true,
  "redirectCount": 0,
  "httpToHttps": { "url": "http://example.com/", "redirectsToHttps": false, "firstHopStatus": 200, "note": "Served over plain HTTP without a redirect to HTTPS" },
  "missingHeaders": ["strict-transport-security", "content-security-policy", "x-frame-options", "x-content-type-options", "referrer-policy", "permissions-policy"],
  "problems": [
    "Missing Strict-Transport-Security (HSTS) header",
    "Missing Content-Security-Policy header",
    "No clickjacking protection (missing X-Frame-Options and CSP frame-ancestors)",
    "Missing X-Content-Type-Options: nosniff",
    "Missing Referrer-Policy header",
    "Missing Permissions-Policy header",
    "HTTP version does not redirect to HTTPS (page served over plain HTTP)"
  ],
  "recommendations": ["Consider Cross-Origin-Opener-Policy: same-origin (isolates your window from cross-origin popups)", "Publish a /.well-known/security.txt with a Contact (RFC 9116)"],
  "checks": { "hsts": { "pass": false, "points": 0, "max": 20, "maxAgeSeconds": null }, "csp": { "pass": false, "points": 0, "max": 20 } },
  "cookies": [],
  "server": "cloudflare",
  "techDisclosure": [],
  "securityTxt": { "found": false, "url": "https://example.com/.well-known/security.txt" },
  "checkedAt": "2026-10-24T22:30:00.000Z"
}

checks has one entry per scored check (shortened above) and headers holds the raw values of every security-relevant header. URLs that can't be reached (DNS failure, timeout, refused) come back as status: "error" and are free. A SUMMARY record in the key-value store has counts per grade.

How much does a security headers check cost?

You pay $0.001 per URL checked ($1 per 1,000 URLs). Unreachable URLs and invalid inputs are free, URLs skipped by Which URLs to save are free too, and the HTTP-to-HTTPS and security.txt requests are included. No start fee.

Job	URLs	Cost
Your 10 sites, weekly header monitor	~40/month	~$0.04/month
Agency: 300 client sites, monthly audit	300/month	$0.30/month
Scan 20,000 company websites for missing headers	20,000	$20

• Apify's free plan includes $5 of monthly credit, enough for about 5,000 URLs a month.
• Paid Apify plans get automatic discounts: Silver -10%, Gold and above -20%.
• Set Maximum cost per run to cap spend; the Actor stops cleanly at the limit.

Bulk security headers checker vs. the alternatives

	This Actor	securityheaders.com / browser extensions	curl -I by hand	Security scanner subscriptions
Many URLs in one go	✅ thousands per run	❌ one at a time	✅ after you write the script	✅
Grade + plain-English fix list	✅	✅	❌	✅
CSP quality (unsafe-inline, unsafe-eval, wildcards)	✅	partly	❌	✅
HTTP to HTTPS redirect, redirect chain, cookies, TLS validity	✅ in one row	partly	DIY	✅
CSV / Excel / JSON / Sheets export, schedules, webhooks	✅	❌	DIY	varies
Callable by AI agents (MCP)	✅	❌	❌	rarely
Cost model	$1 per 1,000 URLs, no subscription	free, manual	free + your time	monthly plan

Use it as an API (Python, JavaScript, cURL)

Python

from apify_client import ApifyClient

client = ApifyClient("<YOUR_APIFY_TOKEN>")
run = client.actor("datawright-labs/security-headers-checker").call(run_input={"urls": ["example.com", "https://github.com/login"]})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item["url"], item.get("grade"), item.get("score"), item.get("missingHeaders"))

JavaScript / Node.js

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: '<YOUR_APIFY_TOKEN>' });
const run = await client.actor('datawright-labs/security-headers-checker').call({ urls: ['example.com'] });
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);

cURL

curl -X POST "https://api.apify.com/v2/acts/datawright-labs~security-headers-checker/run-sync-get-dataset-items?token=<YOUR_APIFY_TOKEN>" \
  -H "Content-Type: application/json" -d '{"urls":["example.com"],"outputFilter":"all"}'

Use it from your AI agent (MCP)

Your AI assistant or agent can run this Actor as a tool through Apify's MCP server, so it can audit security headers on its own while you chat. Add this server to any MCP client that supports remote (Streamable HTTP) servers:

{
  "mcpServers": {
    "datawright-security-headers-checker": {
      "url": "https://mcp.apify.com?tools=datawright-labs/security-headers-checker"
    }
  }
}

On first use your browser opens to sign in to Apify (OAuth). If your client can't do OAuth, add "headers": { "Authorization": "Bearer <YOUR_APIFY_TOKEN>" } instead. The tool shows up as datawright-labs--security-headers-checker, with the same input fields as above, and the agent reads the results with get-dataset-items. Then just ask, for example:

Check the security headers of these 25 websites and list the ones graded C or worse, with the top fix for each.

Want several Datawright tools at once? Comma-separate them: https://mcp.apify.com?tools=datawright-labs/security-headers-checker,datawright-labs/ssl-certificate-checker. Runs are billed per result, exactly like normal runs.

FAQ

How do I check the security headers of a website?

Paste the URL (or just the domain) and run. Each row shows the grade, which of the six key headers are missing or weak, and why. Use headers for the exact values the server sent after all redirects.

Which security headers should every website have?

At minimum Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options: nosniff, clickjacking protection (X-Frame-Options or CSP frame-ancestors) and Referrer-Policy, plus Permissions-Policy. X-XSS-Protection is deprecated and Expect-CT is obsolete; this checker recommends removing them rather than rewarding them.

Does it check whether HTTP redirects to HTTPS?

Yes. With Check HTTP to HTTPS redirect on, it also requests the http:// version and records whether (and after how many hops) it reaches HTTPS. Hosts that don't answer on port 80 at all serve nothing unencrypted and pass.

Why did a well-known site get a low grade?

Many big sites skip headers like CSP or Permissions-Policy on their home page. The grade only reflects the headers on the URL you gave; check login or app pages separately. If a site answers with a bot-protection page (403/503), the headers of that page are graded and a note is added to recommendations.

Is this a vulnerability scanner?

No. It sends normal GET requests (plus one for http:// and one for security.txt) and reads response headers, like a browser does. It doesn't probe for vulnerabilities, so it's safe to run on any public site.

Does it handle invalid or expired SSL certificates?

Yes. The page is still fetched so its headers can be graded, the certificate error (expired, self-signed, wrong host, untrusted) is added to problems, tlsValid is false and the grade is F. For full certificate details and expiry monitoring use the SSL Certificate Checker below.

More tools from Datawright Labs

• SSL Certificate Checker: bulk SSL certificate and domain expiry checks with alerts for expiring, invalid or outdated TLS.
• SPF, DMARC & DKIM Checker: bulk email domain audit of SPF (10-lookup limit), DMARC, DKIM, MX provider, BIMI and MTA-STS.
• WHOIS Domain Lookup (RDAP): bulk registrar, domain age, expiry date, nameservers, EPP status and availability from official registry RDAP.
• Broken Link Checker: find broken links, images and redirects across a whole site.
• Sitemap URL Extractor: get every URL of a site from its sitemaps.
• Bulk PageSpeed & Core Web Vitals Checker: audit PageSpeed / Lighthouse scores for many URLs.
• Website Screenshot API: bulk full-page screenshots and PDFs.
• Google Autocomplete Keyword Scraper: long-tail keyword ideas from Google, YouTube and Bing.
• Greenhouse, Lever & Ashby Jobs Scraper: normalized job feeds from 5 ATS platforms.
• App Store Top Charts & Rank Tracker: daily top free/paid/grossing app rankings with rank changes.

Tip: pair it with the SSL Certificate Checker and the SPF, DMARC & DKIM Checker for a full domain security audit.

Made by Datawright Labs: reliable, fairly priced web data tools. Questions or a missing feature? Open an issue on the Issues tab; we usually reply within a day.