HTTP Security Headers Checker

Grade any site's HTTP security headers in one call — HSTS, CSP, X-Frame-Options and more, with an A–F grade and what's missing. No API key, pay per URL.

▶ Live on the Apify Store: https://apify.com/eliai/security-headers-checker — run it instantly, or call it as an agent tool via Apify MCP.

What it checks

• Strict-Transport-Security (HSTS) — forces HTTPS
• Content-Security-Policy — mitigates XSS/injection
• X-Frame-Options — prevents clickjacking
• X-Content-Type-Options — stops MIME sniffing
• Referrer-Policy — controls referrer leakage
• Permissions-Policy — restricts powerful browser features

Returns an A–F grade + score, the headers present (with values), and the missing ones with why each matters.

Input

{ "url": "https://example.com" }

or bulk:

{ "urls": ["https://a.com", "https://b.com"], "maxUrls": 25 }

Output (per URL)

{
  "url": "https://example.com",
  "grade": "B",
  "securityScore": 66,
  "present": [{ "header": "Strict-Transport-Security (HSTS)", "value": "max-age=31536000" }],
  "missing": [{ "header": "Content-Security-Policy", "why": "Mitigates XSS and content-injection" }],
  "summary": "B (66/100) — 2 missing"
}

Use cases

Security audits, compliance checks, and pre-launch hardening — by hand or wired into a CI/agent pipeline. Pairs with our SEO & Tech Auditor and Broken Link Checker.

Pricing

$0.02 per URL checked — billed as the headers-checked event. Bulk runs are capped by maxUrls, which is also your budget cap.

FAQ

How do I check my site's security headers? Run your URL — you get an A–F grade, every security header present with its value, and each missing one with a one-line explanation of why it matters.

Which headers are checked? The six that security scanners and pentests look for first: Strict-Transport-Security (HSTS), Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.

What's the fastest grade improvement? HSTS, X-Content-Type-Options, and X-Frame-Options are one-line server config additions with almost no breakage risk. CSP is the powerful one but needs testing — start with a report-only policy.

Do missing security headers affect SEO? Not directly as a ranking factor, but they're table stakes in security reviews, enterprise procurement, and compliance checklists — and clickjacking or XSS incidents that headers would have blocked absolutely do damage rankings.

Can I check many sites at once? Yes — pass an array in urls (capped by maxUrls), one graded record per URL. Wire it into CI to catch a config regression before it ships.

For AI agents

This Actor is built to be called by software, not just by people.

• Mount it directly as an MCP tool — no Store search, no ranking, just this one tool: https://mcp.apify.com/?actors=eliai/security-headers-checker
• Or call it over HTTP and get the results in the same request: POST https://api.apify.com/v2/acts/eliai~security-headers-checker/run-sync-get-dataset-items
• Pay with x402, without an Apify account. This Actor is whitelisted for agentic payments, so an agent holding USDC on Base can buy a prepaid token and spend it here. The minimum purchase is $1, the token balance is an absolute spending cap, and it expires 14 days after purchase.
• Costs are predictable before you call. Pricing is pay-per-event (see Pricing above), so an agent can budget a run in advance instead of discovering the bill afterwards.
• Send only the field you mean. If you pass the bulk field, it is used on its own; the single-value field is a fallback, never merged into your request. You are charged for the items you sent and nothing else.