HTTP Security Headers Checker

Grade any site's HTTP security headers in one call — HSTS, CSP, X-Frame-Options and more, with an A–F grade and what's missing. No API key, pay per URL.

▶ Live on the Apify Store: https://apify.com/eliai/security-headers-checker — run it instantly, or call it as an agent tool via Apify MCP.

What it checks

• Strict-Transport-Security (HSTS) — forces HTTPS
• Content-Security-Policy — mitigates XSS/injection
• X-Frame-Options — prevents clickjacking
• X-Content-Type-Options — stops MIME sniffing
• Referrer-Policy — controls referrer leakage
• Permissions-Policy — restricts powerful browser features

Returns an A–F grade + score, the headers present (with values), and the missing ones with why each matters.

Input

{ "url": "https://example.com" }

or bulk:

{ "urls": ["https://a.com", "https://b.com"], "maxUrls": 25 }

Output (per URL)

{
  "url": "https://example.com",
  "grade": "B",
  "securityScore": 66,
  "present": [{ "header": "Strict-Transport-Security (HSTS)", "value": "max-age=31536000" }],
  "missing": [{ "header": "Content-Security-Policy", "why": "Mitigates XSS and content-injection" }],
  "summary": "B (66/100) — 2 missing"
}

Use cases

Security audits, compliance checks, and pre-launch hardening — by hand or wired into a CI/agent pipeline. Pairs with our SEO & Tech Auditor and Broken Link Checker.

Pricing

$0.02 per URL checked — billed as the headers-checked event. Bulk runs are capped by maxUrls, which is also your budget cap.

FAQ

How do I check my site's security headers? Run your URL — you get an A–F grade, every security header present with its value, and each missing one with a one-line explanation of why it matters.

Which headers are checked? The six that security scanners and pentests look for first: Strict-Transport-Security (HSTS), Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.

What's the fastest grade improvement? HSTS, X-Content-Type-Options, and X-Frame-Options are one-line server config additions with almost no breakage risk. CSP is the powerful one but needs testing — start with a report-only policy.

Do missing security headers affect SEO? Not directly as a ranking factor, but they're table stakes in security reviews, enterprise procurement, and compliance checklists — and clickjacking or XSS incidents that headers would have blocked absolutely do damage rankings.

Can I check many sites at once? Yes — pass an array in urls (capped by maxUrls), one graded record per URL. Wire it into CI to catch a config regression before it ships.