HTTP Headers Inspector - full headers + security grade + server fingerprint

Send URLs, get every HTTP response header for each, the redirect result, the response time, and a grade of its security headers (HSTS, CSP and more).

You give it	You get back	You pay (Free plan)
One URL or a list of up to 25; GET or HEAD	Per URL: status, final URL, timing, all headers, security-header analysis, server fingerprint	$0.0004 per URL

Pay per result only: no subscription, no start fee. An unreachable URL returns {ok:false, error} and is not charged. Paid Apify plans get Store discounts on the price above.

Try it in one click

The input form is already filled in with this example. Press Start and you get the output below.

{
  "url": "https://www.cloudflare.com",
  "urls": [
    "https://www.cloudflare.com",
    "https://example.com"
  ]
}

Real output from that exact input (run on 2026-09-24; long arrays shortened to a few entries and long text cut for display):

[
  {
    "ok": true,
    "url": "https://www.cloudflare.com",
    "redirected": true,
    "status": 200,
    "method": "GET",
    "timingMs": 136,
    "headers": {
      "age": "6",
      "alt-svc": "h3=\":443\"; ma=86400",
      "cache-control": "max-age=10",
      "cf-cache-status": "HIT",
      "cf-ray": "a404c0054a770dd9-IAD",
      "connection": "keep-alive",
      "content-encoding": "br",
      "content-security-policy": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.cloudflareinsights.com https://static…",
      "content-type": "text/html; charset=utf-8",
      "cross-origin-opener-policy": "unsafe-none",
      "cross-origin-resource-policy": "cross-origin",
      "date": "Thu, 24 Sep 2026 21:05:56 GMT",
      "last-modified": "Thu, 24 Sep 2026 21:05:49 GMT",
      "link": "<https://www.cloudflare.com/.well-known/agents.json>; rel=\"api-catalog\", <https://www.cloudflare.com/.well-known/webmcp.…",
      "nel": "{\"report_to\":\"cf-nel\",\"success_fraction\":0.0,\"max_age\":604800}",
      "permissions-policy": "geolocation=(), camera=(), microphone=()",
      "referrer-policy": "strict-origin-when-cross-origin",
      "report-to": "{\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=PN7NMEUi0oj0fqIjrUUO5z5…",
      "server": "cloudflare",
      "set-cookie": "__cf_bm=chJFUcExUar0wZTJmgHyEr9It559d7V0_5nMDrn84lI-1790283956.0434752-1.0.1.1-0NnRJzwme58jf_y5J.eyCaCJvt1Or.1zUsR2AGszi…",
      "strict-transport-security": "max-age=31536000; includeSubDomains",
      "transfer-encoding": "chunked",
      "vary": "accept-encoding",
      "x-content-type-options": "nosniff",
      "x-frame-options": "SAMEORIGIN",
      "x-rm": "GW",
      "x-served-by": "marketing-site",
      "x-xss-protection": "1; mode=block"
    },
    "security": {
      "present": [
        "strict-transport-security",
        "content-security-policy"
      ],
      "missing": [],
      "grade": "A"
    },
    "server": {
      "server": "cloudflare",
      "poweredBy": null,
      "via": null
    }
  }
]

Fetch every HTTP response header of any URL, then get a security-header analysis (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) with an A-F grade and a server fingerprint. Single URL or bulk. Built for security reviews, SEO/tech audits, uptime checks, and agent tool-calls.

$0.0004 per URL checked - cheaper than every paid headers/security-header actor measured on the Store. Failed fetches are recorded free.

What you get

• Every response header captured into a clean JSON object.
• Security grade (A-F) from which hardening headers are present vs missing.
• Server fingerprint - Server, X-Powered-By, Via.
• Status, redirect detection, response timing (ms).
• Single or bulk - one url or many urls, capped by maxUrls (1-50).
• Fail-soft: an unreachable URL returns {ok:false, error} and is never charged.

Input

{ "url": "https://github.com", "urls": ["https://example.com"], "method": "GET", "maxUrls": 25 }

Output (real run, 2026-08-07)

{
  "ok": true,
  "url": "https://github.com",
  "finalUrl": "https://github.com/",
  "redirected": true,
  "status": 200,
  "method": "GET",
  "timingMs": 80,
  "headers": { "content-encoding": "gzip", "strict-transport-security": "max-age=31536000; includeSubdomains; preload", "content-security-policy": "default-src 'none'; ...", "x-frame-options": "deny", "x-content-type-options": "nosniff" },
  "security": { "present": ["strict-transport-security","content-security-policy","x-frame-options","x-content-type-options","referrer-policy"], "missing": ["permissions-policy"], "grade": "B" },
  "server": { "server": "GitHub.com", "poweredBy": null, "via": null }
}

An unreachable host comes back uncharged: { "url": "https://bad.invalid", "ok": false, "error": "fetch failed" }

Pricing - $0.0004 per URL, no start fee

Charged once per URL successfully inspected; failed fetches are free. Prices below checked via the Apify Store API on 2026-08-07:

Actor	Pricing	Per URL
This actor	$0.0004 per URL	$0.0004
bgfc97/http-security-headers-audit	$0.0005 per url-audited	$0.0005
andok/security-headers-analyzer	$0.001 per dataset item	$0.001
pink_comic/security-headers-checker	$0.0001 start + $0.002 per item	$0.002

Limits (honest ones)

• Follows redirects and reports the final response; per-hop headers are not itemized (see our HTTP Status Checker for chains).
• maxUrls capped at 50 per run.
• Sites that block non-browser user agents at the CDN may return their block-page headers.
• The security grade reflects header presence, not policy strength (a weak CSP still counts as present).

FAQ

• Does it show every header or just security ones? Every response header, plus a separate security section.
• Can I check many URLs at once? Yes - pass urls (up to 50). Each successful URL is one charge.
• What happens on a dead URL? You get an {ok:false, error} record and are not charged for it.
• Can I use HEAD instead of GET? Yes - set method to HEAD, OPTIONS, etc.
• Is the grade an official standard? No - it is a simple present/missing score across six common hardening headers, meant for quick triage.

When not to use this

• You need a security posture score you can hand an auditor. The grade counts how many of six hardening headers are present. It says nothing about whether your CSP is any good. Use a dedicated CSP evaluator for policy strength.
• You need the full redirect chain. Redirects are followed and only the final response is reported. For per-hop status codes and headers, use an HTTP status/redirect chain checker.
• You need TLS certificate details. Cipher suites, chain, expiry and CT logs are not covered - this reads HTTP response headers only.
• You need what a browser sees after JavaScript. Headers come from a plain HTTP request; there is no headless browser, so headers set by service workers or meta-equivalent CSP tags are not included.
• The target blocks non-browser clients. A CDN that challenges the request returns its own block page headers, which will look like a badly configured site rather than an error.

Use from code or AI agents

curl -X POST "https://api.apify.com/v2/acts/EliAI~http-headers-inspector/runs?token=YOUR_APIFY_TOKEN" \
  -H 'content-type: application/json' \
  -d '{"url":"https://github.com"}'

Callable as an agent tool through the Apify MCP server (mcp.apify.com) - add the actor and your LLM can inspect headers on demand. Every record with ok:false is a diagnostic, not a result.

Who uses it

• Security engineers grading HSTS, CSP and X-Frame-Options across a list of sites
• DevOps teams confirming cache and security headers after a CDN change
• SEO specialists checking status codes and redirect headers on key URLs
• Pentesters fingerprinting server software from response headers
• Agencies adding a security-header grade to client audits

Changelog

• 2026-09-24: New summary at the top of this page: what you send, what you get, the price, and a real output from the prefilled example.