HTTP Security Headers Auditor

Checks the HTTP response headers of any public URL against a set of well-known security header recommendations — Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and the Cross-Origin-Opener-Policy / Cross-Origin-Resource-Policy pair. You get back a 0-100 score, a letter grade, and a list of concrete fixes for anything missing or weakly configured.

What it does

The Actor sends a single HTTP request to the URL you provide, reads the response headers (following redirects by default), and runs each of the eight headers above through a weighted check: a header can be fully present and correctly configured, present but weak (e.g. a short max-age on HSTS, or unsafe-inline in a CSP), or missing entirely. Weights are summed into a score out of 100 and mapped to a letter grade (A ≥ 90, B ≥ 75, C ≥ 60, D ≥ 40, F below that).

Input

Field	Type	Required	Default	Description
url	string	yes	—	Full URL of the site to audit (e.g. https://example.com).
followRedirects	boolean	no	true	Follow HTTP redirects before analyzing the headers.
timeoutMs	integer	no	10000	Maximum time to wait for the HTTP response, in milliseconds.

Output

One dataset row per run:

Field	Description
url	Final URL analyzed, after any redirects.
statusCode	HTTP status code returned by the server.
headersPresent	Security headers detected in the response.
headersMissing	Recommended security headers absent from the response.
score	Overall header security score, from 0 to 100.
grade	Letter grade (A–F) matching the score.
recommendations	Concrete advice for fixing missing or misconfigured headers.

If the request fails (invalid URL, timeout, DNS error, etc.), the row instead contains url and an error message, and no charge is made.

Pricing

Pay per event: $0.004 per url audited. One URL's response headers fetched, scored and graded with recommendations (charged even when every header is already correct).

You only pay for these events: the platform usage of the run is covered by the Actor. Failed fetches are not charged. You can cap the cost of a run with the maximum charge setting of your run.

Limits

• One URL per run; only publicly reachable HTTP(S) endpoints are supported.
• No authentication, proxy, or personal data handling — only the target site's public response headers are read.
• Very slow or unresponsive servers will fail once timeoutMs is reached.

Use in your workflow

Replace <APIFY_TOKEN> with your token from Apify Console → Settings → API & Integrations.

HTTP API (curl) — run and get the results in one call:

curl -X POST "https://api.apify.com/v2/acts/devoted_laureate_r8f~audit-des-en-t-tes-de-s-curit-http/run-sync-get-dataset-items" \
  -H "Authorization: Bearer <APIFY_TOKEN>" -H "Content-Type: application/json" \
  -d '{"url": "https://www.wikipedia.org/", "followRedirects": true, "timeoutMs": 10000}'

JavaScript (npm install apify-client):

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: process.env.APIFY_TOKEN });
const run = await client.actor('devoted_laureate_r8f/audit-des-en-t-tes-de-s-curit-http').call({"url": "https://www.wikipedia.org/", "followRedirects": true, "timeoutMs": 10000});
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);

Python (pip install apify-client):

import os
from apify_client import ApifyClient

client = ApifyClient(os.environ["APIFY_TOKEN"])
run = client.actor("devoted_laureate_r8f/audit-des-en-t-tes-de-s-curit-http").call(run_input={"url": "https://www.wikipedia.org/", "followRedirects": True, "timeoutMs": 10000})
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

AI agents (MCP) — expose only this Actor as a tool through the Apify MCP server:

{
  "mcpServers": {
    "security-headers-check": {
      "url": "https://mcp.apify.com?tools=devoted_laureate_r8f/audit-des-en-t-tes-de-s-curit-http",
      "headers": {
        "Authorization": "Bearer <APIFY_TOKEN>"
      }
    }
  }
}

For agents: call it when you need to know whether a website sends the recommended HTTP security headers. Input: url (one page); optional followRedirects, timeoutMs. Output: one record with a score, a letter grade, the headers present/missing and a recommendation per issue. Cost: $0.004 per url audited; failures are not charged.

FAQ

Which headers are checked?

Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy.

How is the grade computed?

Each header contributes to a score from its presence and configuration; the score maps to a letter grade, and every missing or weak header comes with a recommendation.

Am I charged if all headers are fine?

Yes, one event per URL audited: you still receive the full audit and grade.

Related tools

• Website Tech Stack Detector - CMS & Frameworks — know the server/CDN/CMS before fixing headers