HTTP Security Headers Checker: CSP HSTS Header Scanner with A-F Grades

Security Headers Checker grades a website's HTTP security headers from A to F, covering HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, at $0.02 per URL on the Apify Free plan.

• Price: $0.02 per URL checked on the Free plan, less on paid plans.
• Example input: { "url": "https://example.com" }
• Output fields: url, finalUrl, statusCode, https, grade, securityScore, present, missing, server, poweredBy, summary, error

Grade any site's HTTP security headers in one call — HSTS, CSP, X-Frame-Options and more, with an A–F grade and what's missing. No API key, pay per URL.

▶ Live on the Apify Store: https://apify.com/eliai/security-headers-checker — run it instantly, or call it as an agent tool via Apify MCP.

What it checks

• Strict-Transport-Security (HSTS) — forces HTTPS
• Content-Security-Policy — mitigates XSS/injection
• X-Frame-Options — prevents clickjacking
• X-Content-Type-Options — stops MIME sniffing
• Referrer-Policy — controls referrer leakage
• Permissions-Policy — restricts powerful browser features

Returns an A–F grade + score, the headers present (with values), and the missing ones with why each matters.

Input

{ "url": "https://example.com" }

or bulk:

{ "urls": ["https://a.com", "https://b.com"], "maxUrls": 25 }

Output (per URL)

{
  "url": "https://example.com",
  "grade": "B",
  "securityScore": 66,
  "present": [{ "header": "Strict-Transport-Security (HSTS)", "value": "max-age=31536000" }],
  "missing": [{ "header": "Content-Security-Policy", "why": "Mitigates XSS and content-injection" }],
  "summary": "B (66/100) — 2 missing"
}

Use cases

Security audits, compliance checks, and pre-launch hardening — by hand or wired into a CI/agent pipeline. Pairs with our SEO & Tech Auditor and Broken Link Checker.

Pricing

$0.02 per URL checked on the Apify Free plan, billed as the headers-checked event. Paid Apify plans pay less ($0.0186 Bronze, $0.0174 Silver, $0.016 Gold, $0.0146 Platinum, $0.0134 Diamond). No start fee. A URL that cannot be fetched comes back with an error field. Bulk runs are capped by maxUrls (25 by default), which is also your budget cap.

Limits

• Default run settings: 256 MB memory, 600 s timeout. Change them per run under Options if a large input needs more.
• Time: the prefilled example finished in 2 s on 2026-10-31; run time grows with the number of inputs.

FAQ

How do I check my site's security headers? Run your URL — you get an A–F grade, every security header present with its value, and each missing one with a one-line explanation of why it matters.

Which headers are checked? The six that security scanners and pentests look for first: Strict-Transport-Security (HSTS), Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.

What's the fastest grade improvement? HSTS, X-Content-Type-Options, and X-Frame-Options are one-line server config additions with almost no breakage risk. CSP is the powerful one but needs testing — start with a report-only policy.

How is the grade calculated? Each of the six headers counts equally. securityScore is the share present, out of 100, and the grade follows it: A at 83 and up, B at 66, C at 50, D at 33, F below. It checks that a header is present, not how strict its value is.

Can I check many sites at once? Yes — pass an array in urls (capped by maxUrls), one graded record per URL. Wire it into CI to catch a config regression before it ships.

Changelog

• 2026-11-01: Page text only: a clearer page heading and a Limits section. Code, output and price are unchanged.

For AI agents

This Actor is built to be called by software, not just by people.

• Mount it directly as an MCP tool — no Store search, no ranking, just this one tool: https://mcp.apify.com/?actors=eliai/security-headers-checker
• Or call it over HTTP and get the results in the same request: POST https://api.apify.com/v2/acts/eliai~security-headers-checker/run-sync-get-dataset-items
• Costs are predictable before you call. Pricing is pay-per-event (see Pricing above), so an agent can budget a run in advance instead of discovering the bill afterwards.
• Send only the field you mean. If you pass the bulk field, it is used on its own; the single-value field is a fallback, never merged into your request. You are charged for the items you sent and nothing else.