Pricing

Pay per usage

Website Security Headers Checker

Audit HTTP security headers for any URL: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. Returns a 0-100 score + letter grade + actionable findings. $0.005 per URL.

Pricing

Pay per usage

Rating

0.0

(0)

Developer

Hojun Lee

Actor stats

Bookmarked

Total users

Monthly active users

a day ago

Last modified

Why check security headers?

Security headers are the first line of defense against XSS, clickjacking, MIME sniffing, and data leakage. Yet most websites ship with zero or misconfigured headers — leaving visitors exposed. Major bug bounty programs (HackerOne, Bugcrowd) explicitly award points for missing headers.

This actor gives you a quantified, actionable report in seconds: what's missing, what's misconfigured, and how severe each issue is — without running a full pentest.

What you get

Per-URL output

{
  "_type": "security_audit",
  "url": "https://example.com",
  "ok": true,
  "score": 45,
  "grade": "D",
  "https": true,
  "final_url": "https://example.com/",
  "status_code": 200,
  "server": "nginx/1.24",
  "headers_present": {
    "strict-transport-security": "max-age=31536000; includeSubDomains",
    "x-content-type-options": "nosniff"
  },
  "headers_missing": [
    "content-security-policy",
    "x-frame-options",
    "referrer-policy",
    "permissions-policy"
  ],
  "findings": [
    {
      "header": "content-security-policy",
      "severity": "high",
      "finding": "Missing content-security-policy — restricts allowed content sources"
    }
  ]
}

Input Parameters

Parameter	Type	Default	Description
`urls`	array	—	List of URLs to audit (batch mode)
`url`	string	—	Single URL to audit (used when `urls` is empty)
`followRedirects`	boolean	`true`	Follow HTTP → HTTPS redirects and audit the final URL
`userAgent`	string	—	Custom User-Agent for requests

Scoring

Header	Weight	Notes
`Content-Security-Policy`	25 pts	Deducted if `unsafe-inline`, `unsafe-eval`, or wildcards present
`Strict-Transport-Security`	20 pts	Deducted if max-age < 1 year or missing `includeSubDomains`
`X-Frame-Options`	15 pts	DENY or SAMEORIGIN
`X-Content-Type-Options`	10 pts	Must be `nosniff`
`Referrer-Policy`	10 pts
`Permissions-Policy`	10 pts
`X-XSS-Protection`	5 pts	Legacy but still checked
`Cross-Origin-Opener-Policy`	5 pts

Grade	Score
A+	90-100
A	80-89
B	70-79
C	60-69
D	50-59
F	0-49

Use cases

Security audits — Bulk-check all your domains before a pentest engagement
Compliance — Verify headers meet PCI-DSS / HIPAA / SOC2 requirements
Bug bounty recon — Quickly scan targets for easy header wins
DevOps monitoring — Schedule weekly checks; alert on regression
Client reporting — Generate a scored report per domain for security consulting

Quick start

Single site

{ "url": "https://yourcompany.com" }

Bulk audit

{
  "urls": [
    "https://site1.com",
    "https://site2.com"
  ]
}

Pricing

Pay-Per-Event: $0.005 per URL audited.

Run	URLs	Cost
Single site audit	1	$0.005
10-domain report	10	$0.05
100-domain bulk check	100	$0.50

Phishing URL Detector — Check URLs for phishing indicators
Email & Domain OSINT — WHOIS, DNS, SSL, breach data
HTML Metadata Extractor — OpenGraph, JSON-LD, meta tags

Feedback

Leave a review on Apify Store

Security Headers Checker API - HTTP Security Scanner

pink_comic/security-headers-checker

Security Headers Checker API for bulk HTTP security scans. Audit HSTS, CSP, X-Frame-Options, referrer and permissions policies, missing headers, website hardening gaps, and compliance posture. Returns grades, findings, and header evidence for security audits.

Ava Torres

🛡️ Security Headers Checker

taroyamada/security-headers-checker

Audit HTTP security headers in bulk across hundreds of websites. Extract OWASP compliance grades and detect missing HSTS or CSP directives instantly.

naoki anzai

HSTS Header Checker - Strict-Transport-Security audit

scrappy_garden/hsts-header-checker

Fetches URLs and validates the Strict-Transport-Security (HSTS) response header. Parses directives (max-age/includeSubDomains/preload), flags missing/invalid configuration, and checks common best practices. Outputs per-URL results plus SUMMARY and REPORT.

Bikram Adhikari

Security Headers Checker

pillowy_travel/security-headers-checker

Analyze HTTP security headers of websites and generate a security score. Detect missing headers like CSP, HSTS, X-Frame-Options, and more. Perfect for web security audits, vulnerability checks, learning, and automated monitoring.

SAHIL KUMAR

Broken Link Checker - Website Link Validator & 404 Finder

scrappy_garden/broken-link-checker

Crawl a website (or list of pages) and detect broken links (404/500), unreachable URLs, and invalid asset references. Generates a structured report for SEO audits, QA testing, and website maintenance.

Bikram Adhikari

Website & Domain Health Audit — SSL, DNS, Email, Security Score

inexhaustible_glass/domain-health-audit

Complete website & domain audit in one run: SSL/TLS, DNS, SPF/DKIM/DMARC email security, security headers, tech stack, WHOIS, blacklist & uptime — with a health score and fix list. No API key.

Hitman studio

Security Headers Checker - Audit CSP, HSTS, XFO and more

scrappy_garden/security-headers-checker

Check common HTTP security headers for one or more URLs (Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP). Useful for quick security hardening audits.

Bikram Adhikari

Web Page Change Monitor - Track Website Changes & Get Alerts

scrappy_garden/web-page-change-monitor

Monitor any website for changes automatically. Track content updates, price changes, product availability, news updates. Get instant alerts when pages change. Perfect for competitor monitoring, price tracking, content surveillance, and automated change detection. Export change history to JSON.

Bikram Adhikari

Security Headers Checker - Grade CSP, HSTS, X-Frame-Options

eliai/security-headers-checker

Security headers checker for any URL: pass a list of URLs, get one JSON record per URL with the observed CSP, HSTS, X-Frame-Options and related headers, missing-header findings, and a security grade. Pay per result â€” cost is bounded by the URLs you submit.

Anthony Snider

SSL Certificate Checker

scrappy_garden/ssl-certificate-checker

Check SSL/TLS certificates for any website: expiration date, issuer, subject, hostname match (SNI), chain/authorization status, and common HTTPS misconfigurations. Useful for SEO audits, security checks, and uptime monitoring.

Bikram Adhikari

Favicon Checker

scrappy_garden/favicon-checker

Check if a website has a valid favicon and icon setup for SEO and UX. Detects <link rel=icon> tags, default /favicon.ico, Apple touch icons, mask-icon, and web manifest icons. Validates URLs, HTTP status codes, content types, and reports missing/broken icons.

Bikram Adhikari