HTTP Headers Inspector - full headers + security grade + server fingerprint

Send URLs, get every HTTP response header for each, the redirect result, the response time, and a grade of its security headers (HSTS, CSP and more).

You give it	You get back	You pay (Free plan)
One URL or a list of up to 25; GET or HEAD	Per URL: status, final URL, timing, all headers, security-header analysis, server fingerprint	$0.0004 per URL

Pay per result only: no subscription, no start fee. An unreachable URL returns {ok:false, error} and is not charged. Paid Apify plans get Store discounts on the price above.

Example: try it in one click

The input form is already filled in with this example. Press Start and you get the output below.

{
  "url": "https://www.cloudflare.com",
  "urls": [
    "https://www.cloudflare.com",
    "https://www.wikipedia.org"
  ]
}

Real output from that exact input (run on 2026-10-31; long arrays shortened to a few entries and long text cut for display):

[
  {
    "ok": true,
    "url": "https://www.cloudflare.com",
    "finalUrl": "https://www.cloudflare.com/",
    "redirected": true,
    "status": 200,
    "method": "GET",
    "timingMs": 83,
    "headers": {
      "age": "6",
      "alt-svc": "h3=\":443\"; ma=86400",
      "cache-control": "max-age=10",
      "cf-cache-status": "HIT",
      "cf-ray": "a5368430a929fbda-IAD",
      "connection": "keep-alive",
      "content-encoding": "br",
      "content-security-policy": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflareinsights.com https://static-staging.cloudflareinsights.com https://…",
      "content-type": "text/html; charset=utf-8",
      "cross-origin-opener-policy": "unsafe-none",
      "cross-origin-resource-policy": "cross-origin",
      "date": "Sat, 31 Oct 2026 23:42:27 GMT",
      "link": "<https://www.cloudflare.com/.well-known/api-catalog>; rel=\"api-catalog\", <https://www.cloudflare.com/.well-known/agents.json>; rel=\"service-desc\", <https://www.…",
      "nel": "{\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}",
      "permissions-policy": "geolocation=(), camera=(), microphone=()",
      "referrer-policy": "strict-origin-when-cross-origin",
      "report-to": "{\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=HCbUfmwf6nTgYBJ9yM6RBE9%2FtVYtuo%2BnZVNnJRTgwDMltNs0TdWoudBLKAn…",
      "server": "cloudflare",
      "set-cookie": "__cf_bm=MpDgZ7nOI7aVEqxfFHgPn_Aqj0LtMueWtR8KEQKBpuA-1793490147.941582-1.0.1.1-y76VsX6JQnRBPpcgG1tiUWTj_DYABg_w6SKLrxQXVJZ9yDXTSjwG8TYcqisBZ_gk0LvqI4CCK8oKDpv0Be…",
      "strict-transport-security": "max-age=31536000; includeSubDomains",
      "transfer-encoding": "chunked",
      "vary": "accept-encoding",
      "x-content-type-options": "nosniff",
      "x-frame-options": "SAMEORIGIN",
      "x-rm": "GW"
    },
    "security": {
      "present": [
        "strict-transport-security",
        "content-security-policy",
        "x-frame-options",
        "… 3 more"
      ],
      "missing": [],
      "grade": "A"
    },
    "server": {
      "server": "cloudflare",
      "poweredBy": null,
      "via": null
    }
  },
  {
    "ok": true,
    "url": "https://www.wikipedia.org",
    "finalUrl": "https://www.wikipedia.org/",
    "redirected": true,
    "status": 200,
    "method": "GET",
    "timingMs": 113,
    "headers": {
      "accept-ranges": "bytes",
      "age": "39984",
      "cache-control": "s-maxage=86400, must-revalidate, max-age=3600",
      "content-encoding": "gzip",
      "content-length": "28883",
      "content-type": "text/html",
      "date": "Sat, 31 Oct 2026 12:36:03 GMT",
      "etag": "W/\"1de35-65f0f30bb66c0\"",
      "last-modified": "Fri, 30 Oct 2026 13:58:27 GMT",
      "nel": "{ \"report_to\": \"wm_nel\", \"max_age\": 604800, \"failure_fraction\": 0.05, \"success_fraction\": 0.0}",
      "report-to": "{ \"group\": \"wm_nel\", \"max_age\": 604800, \"endpoints\": [{ \"url\": \"https://intake-logging.wikimedia.org/v1/events?stream=w3c.reportingapi.network_error&schema_uri=…",
      "server": "mw-web.codfw.main-7c8b67c8f5-dkjfh",
      "server-timing": "cache;desc=\"hit-front\", host;desc=\"cp2046\",co_id;desc=\"3219576193\"",
      "set-cookie": "WMF-Uniq=4lAji_tWAyLjFQkbOhUsJwQKAAAAAFvdATr0kmOXPB40AQlHaqtLWHEE_-l7GPPP;Domain=.wikipedia.org;Path=/;HttpOnly;secure;SameSite=None;Expires=Sun, 31 Oct 2027 00…",
      "strict-transport-security": "max-age=106384710; includeSubDomains; preload",
      "vary": "Accept-Encoding",
      "x-analytics": "",
      "x-cache": "cp2046 miss, cp2046 hit/1328740",
      "x-cache-status": "hit-front",
      "x-client-ip": "54.208.18.194",
      "x-request-id": "26498896-6560-4753-bf15-a9ac5231198b"
    },
    "security": {
      "present": [
        "strict-transport-security"
      ],
      "missing": [
        "content-security-policy",
        "x-frame-options",
        "x-content-type-options",
        "… 2 more"
      ],
      "grade": "F"
    },
    "server": {
      "server": "mw-web.codfw.main-7c8b67c8f5-dkjfh",
      "poweredBy": null,
      "via": null
    }
  }
]

Fetch every HTTP response header of any URL, then get a security-header analysis (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) with an A-F grade and a server fingerprint. Single URL or bulk. Built for security reviews, SEO/tech audits, uptime checks, and agent tool-calls.

$0.0004 per URL checked - cheaper than every paid headers/security-header actor measured on the Store. Failed fetches are recorded free.

What you get

• Every response header captured into a clean JSON object.
• Security grade (A-F) from which hardening headers are present vs missing.
• Server fingerprint - Server, X-Powered-By, Via.
• Status, redirect detection, response timing (ms).
• Single or bulk - one url or many urls, capped by maxUrls (1-50).
• Fail-soft: an unreachable URL returns {ok:false, error} and is never charged.

Input

{ "url": "https://github.com", "urls": ["https://example.com"], "method": "GET", "maxUrls": 25 }

Output (real run, 2026-08-07)

{
  "ok": true,
  "url": "https://github.com",
  "finalUrl": "https://github.com/",
  "redirected": true,
  "status": 200,
  "method": "GET",
  "timingMs": 80,
  "headers": { "content-encoding": "gzip", "strict-transport-security": "max-age=31536000; includeSubdomains; preload", "content-security-policy": "default-src 'none'; ...", "x-frame-options": "deny", "x-content-type-options": "nosniff" },
  "security": { "present": ["strict-transport-security","content-security-policy","x-frame-options","x-content-type-options","referrer-policy"], "missing": ["permissions-policy"], "grade": "B" },
  "server": { "server": "GitHub.com", "poweredBy": null, "via": null }
}

An unreachable host comes back uncharged: { "url": "https://bad.invalid", "ok": false, "error": "fetch failed" }

Pricing - $0.0004 per URL, no start fee

Charged once per URL successfully inspected; failed fetches are free. Prices below checked via the Apify Store API on 2026-08-07:

Actor	Pricing	Per URL
This actor	$0.0004 per URL	$0.0004
bgfc97/http-security-headers-audit	$0.0005 per url-audited	$0.0005
andok/security-headers-analyzer	$0.001 per dataset item	$0.001
pink_comic/security-headers-checker	$0.0001 start + $0.002 per item	$0.002

Limits (honest ones)

• Follows redirects and reports the final response; per-hop headers are not itemized (see our HTTP Status Checker for chains).
• maxUrls capped at 50 per run.
• Sites that block non-browser user agents at the CDN may return their block-page headers.
• The security grade reflects header presence, not policy strength (a weak CSP still counts as present).

FAQ

• Does it show every header or just security ones? Every response header, plus a separate security section.
• Can I check many URLs at once? Yes - pass urls (up to 50). Each successful URL is one charge.
• What happens on a dead URL? You get an {ok:false, error} record and are not charged for it.
• Can I use HEAD instead of GET? Yes - set method to HEAD, OPTIONS, etc.
• Is the grade an official standard? No - it is a simple present/missing score across six common hardening headers, meant for quick triage.

When not to use this

• You need a security posture score you can hand an auditor. The grade counts how many of six hardening headers are present. It says nothing about whether your CSP is any good. Use a dedicated CSP evaluator for policy strength.
• You need the full redirect chain. Redirects are followed and only the final response is reported. For per-hop status codes and headers, use an HTTP status/redirect chain checker.
• You need TLS certificate details. Cipher suites, chain, expiry and CT logs are not covered - this reads HTTP response headers only.
• You need what a browser sees after JavaScript. Headers come from a plain HTTP request; there is no headless browser, so headers set by service workers or meta-equivalent CSP tags are not included.
• The target blocks non-browser clients. A CDN that challenges the request returns its own block page headers, which will look like a badly configured site rather than an error.

Use from code or AI agents

curl -X POST "https://api.apify.com/v2/acts/EliAI~http-headers-inspector/runs?token=YOUR_APIFY_TOKEN" \
  -H 'content-type: application/json' \
  -d '{"url":"https://github.com"}'

Callable as an agent tool through the Apify MCP server (mcp.apify.com) - add the actor and your LLM can inspect headers on demand. Every record with ok:false is a diagnostic, not a result.

Who uses it

• Security engineers grading HSTS, CSP and X-Frame-Options across a list of sites
• DevOps teams confirming cache and security headers after a CDN change
• SEO specialists checking status codes and redirect headers on key URLs
• Pentesters fingerprinting server software from response headers
• Agencies adding a security-header grade to client audits

Changelog

• 2026-11-01: Page text only: the prefilled example now uses a real site instead of a placeholder, the "Try it" output re-run with the new example and the "Try it" block is now headed Example. Code, output and price are unchanged.
• 2026-09-24: New summary at the top of this page: what you send, what you get, the price, and a real output from the prefilled example.