HTTP Security Headers & OWASP Posture Auditor

A security headers checker that audits HTTP response headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, CORP, COEP) for any URL. Returns a 0–100 grade, a letter rating (A–F), and a prioritized fix list with exact header values to add.

A single polite GET per URL — no crawling, no forms, no auth. Built for security teams, DevOps, QA, and agencies who need a fast http security headers check across a portfolio of sites.

What is an HTTP Security Headers Checker?

This actor scans any URL's response headers against OWASP-recommended security controls. Instead of manually inspecting headers or visiting multiple online checkers one site at a time, you submit a list of URLs and get back a scored report with prioritized remediation for each one. Use it programmatically via the Apify API, in CI/CD pipelines, or as a scheduled weekly scan.

What data does the auditor return?

One dataset row per URL: url, http_status, final_url, redirected, queried_at, https_enabled, ownership_verified (only when you supply a verification token), posture_score, posture_grade, issue_count, top_fix, and the full issues array. Each response header also gets its own field (hsts, csp, x_frame_options, x_content_type_options, referrer_policy, permissions_policy, coop, corp, coep) plus a header_detail object carrying the raw value and the assessment behind each verdict. Export the dataset as JSON, CSV, or Excel straight from the run page.

How to Check Security Headers for Any URL

1. Open the actor on the Apify Store and hit Start (or call it from the API — see Integration).
2. Paste your URLs into the URLs to audit field, one per line. Your own sites ideally; for third-party domains set the optional ownership-verification token so the run records ownership_verified.
3. Run it. Each URL gets a single HTTPS GET; a two-URL check finishes in seconds.
4. Read the report. Every URL row carries posture_score, posture_grade, issue_count, top_fix, and the full issues array — each issue names the header, its severity, and the exact value to add.
5. Fix top_fix first. Issues are sorted critical → low, so the first row is the highest-impact change — usually CSP or HSTS.
6. Re-run to confirm the grade moved, then schedule the actor to catch regressions.

No crawling, no headless browser, no JavaScript execution — the checker reads response headers only. That keeps it fast and safe to point at production.

Security Headers Checked (OWASP Secure Headers Project)

The OWASP Secure Headers Project is the reference list this auditor scores against.

Header	What it prevents	Severity if missing
🔴 Content-Security-Policy (CSP)	XSS and data injection — the single most important security header	Critical
🔴 Strict-Transport-Security (HSTS)	SSL-strip MITM; forces HTTPS (RFC 6797)	High
🟠 X-Frame-Options	Clickjacking (DENY / SAMEORIGIN)	Medium
🟠 X-Content-Type-Options	MIME-sniffing XSS (nosniff)	Medium
🟡 Referrer-Policy	Referrer leakage to third parties	Low
🟡 Permissions-Policy	Locks down browser features (camera, mic, geo, payment)	Low
🟡 COOP / CORP / COEP	Cross-origin isolation for Spectre-class security	Low

Each URL gets a 0–100 posture score (A–F grade), issues sorted by severity with a copy-pasteable fix per issue, and a top_fix summary.

Security Headers Audit Use Cases

• Security & compliance teams — scan your asset inventory weekly to catch missing headers and CSP regressions.
• DevOps / SRE — verify new deployments ship the full OWASP security header set before they hit production.
• Agencies & consultants — generate a prioritized security headers audit report per client site in one run.
• Bug-bounty / recon — quick http header analyzer triage on in-scope targets.
• PCI-DSS / SOC 2 evidence — capture header presence and configuration per asset for the auditor asking about your perimeter.

Input Example

{
  "urls": ["https://example.com", "https://github.com"]
}

Input fields

Field	Type	Notes
urls	array, required	One or more URLs to audit. A bare hostname like example.com is upgraded to https://example.com.
verifyToken	string, secret, optional	When set, the auditor looks for <meta name="headers-audit-verify" content="TOKEN"> in the response and sets ownership_verified: true on the row if it matches exactly. Recommended when auditing third-party domains to prove you own them.
timeoutSecs	integer 3–60, default 15	Per-request timeout in seconds.

URLs that fail to resolve, time out, or refuse the connection still produce a row, with status: "error" and the failure reason — they are not retried and not charged as audited URLs.

Output Example (per URL)

Measured output for https://example.com on build 0.1.13 (2026-09-23):

{
  "url": "https://example.com",
  "original_input": "https://example.com",
  "http_status": 200,
  "final_url": "https://example.com/",
  "redirected": false,
  "queried_at": "2026-09-23T13:03:52.308Z",
  "status": "ok",
  "https_enabled": true,
  "posture_score": 34,
  "posture_grade": "F",
  "csp": "missing",
  "hsts": "missing",
  "issue_count": 9,
  "top_fix": "Add: Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'",
  "issues": [
    { "severity": "critical", "area": "CSP", "message": "CSP header is missing…", "fix": "Add: Content-Security-Policy…" },
    { "severity": "high", "area": "HSTS", "message": "HSTS header is missing…", "fix": "Add: Strict-Transport-Security…" },
    { "severity": "medium", "area": "X-Frame-Options", "message": "X-Frame-Options is missing…" },
    { "severity": "low", "area": "COEP", "message": "COEP is missing…" }
  ]
}

For comparison, the same two-URL smoke run scored https://github.com 75 (C) with 5 issues — the grade separates a hardened site from a bare one at a glance. Elided issues entries and the per-header header_detail objects are omitted here for brevity; the dataset returns them in full.

Each URL also gets a letter grade alongside the numeric score:

Grade	Posture score	What it means
A	90–100	All critical headers present with restrictive values
B	80–89	Minor gaps only
C	70–79	Several headers weak or missing
D	50–69	Multiple critical gaps
F	0–49	Most or all headers missing

Scoring starts at 100 and deducts per problem: CSP −20, HSTS −15, X-Frame-Options −8, X-Content-Type-Options −6, Referrer-Policy −4, Permissions-Policy −4, COOP/CORP/COEP −3 each. A header that is present but weak (a CSP wildcard, an HSTS max-age under six months) deducts 60% of its weight instead and is filed as a low-severity issue. A site not served over HTTPS loses 25 points and gets a critical issue at the top of the list.

Pricing (Pay-Per-Event)

Event	Unit	Price
actor-start	per run	$0.01
url-audited	per URL fetched and scored	$0.02
issue-flagged	per issue flagged (capped at 8 per URL)	$0.01

Example cost: 100 URLs × average 4 issues each = $0.01 + (100 × $0.02) + (400 × $0.01) = $6.01 (≈ 6¢ per URL).

Smaller run: 10 URLs × average 4 issues = $0.01 + $0.20 + $0.40 = $0.61.

Worst case per URL: issue-flagged is capped at 8 per URL, so issue events can never exceed $0.08 for a URL — a heavily broken site still costs at most $0.10 to audit plus the one-time $0.01 actor start.

Volume discounts: prices scale down with your Apify plan tier — BRONZE −10%, SILVER −20%, GOLD −30%, PLATINUM −40%, DIAMOND −50% on every event above.

Integrate a Security Headers Test into CI/CD

Run the security headers API from any stack

• API / SDK — standard Apify actor; call it via the HTTP API, the JavaScript SDK, or the Python SDK. The API tab on the Store page has ready-made snippets.
• Bulk — pass hundreds of URLs in one run; each URL is fetched sequentially and politely, so scanning your own portfolio creates no rate-limit pressure.

Fail the build in CI/CD

• Deploy gate — call the actor from GitHub Actions, GitLab CI, or Jenkins and fail the build when posture_grade drops below your threshold (the smoke input {"urls": ["https://github.com", "https://example.com"]} is a quick way to see the shape of the output first).
• Scheduled drift detection — run weekly and alert when a grade falls, so a misconfigured CDN or a rolled-back server config is caught the same day.

Automation without code

• Webhooks — POST results to Make, n8n, or Zapier when the run finishes.
• Error rows instead of silence — a run with no usable URLs still writes a structured error record (error: invalid_input or no_results) to the dataset, so a pipeline never mistakes an empty result for a clean bill of health.

Other Apify Actors

• SSL/TLS Certificate Expiry Monitor — monitor certificate expiry, detect changes, and get alerts for any HTTPS domain. Pairs naturally with security headers auditing for a full transport-layer security check.
• Email Deliverability & Domain Posture Auditor — audit SPF, DKIM, DMARC, MTA-STS, and BIMI for any domain. Complete your email security posture alongside HTTP header checks.

Frequently Asked Questions

What are the most important HTTP security headers?

Content-Security-Policy (CSP) and Strict-Transport-Security (HSTS) are the most impactful — CSP is your strongest XSS defense and HSTS prevents SSL-stripping MITM attacks. X-Frame-Options and X-Content-Type-Options are also essential for clickjacking and MIME-sniffing protection. OWASP maintains a Secure Headers Project with a full reference list.

How do I check if my website has security headers?

Pass the URL to this actor. It performs a single GET request and inspects all response headers against the OWASP security headers checklist. You get a scored report with exact fixes for every missing or misconfigured header.

What is the difference between COOP, CORP, and COEP?

Cross-Origin-Opener-Policy (COOP) isolates top-level windows from cross-origin popups. Cross-Origin-Resource-Policy (CORP) controls who can load your resources cross-origin. Cross-Origin-Embedder-Policy (COEP) requires cross-origin isolation for powerful browser features like SharedArrayBuffer. They work together for Spectre-class security.

How do I fix missing HSTS?

Add the Strict-Transport-Security header to your web server or CDN configuration with a max-age of at least one year: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload. This tells browsers to always connect via HTTPS for the specified duration.

What is CSP and why is it critical?

Content-Security-Policy is a browser security mechanism that controls which resources (scripts, styles, images, fonts) a page is allowed to load. A properly configured CSP blocks inline scripts, restricts origins, and is the single most effective defense against cross-site scripting (XSS) attacks. This auditor flags wildcard directives and unsafe patterns ('unsafe-inline', 'unsafe-eval').

How do I test security headers online?

Paste the URL into this actor and press Start — there is nothing to install and no signup beyond Apify itself. It is an online security headers test that returns machine-readable JSON rather than a screenshot, so you can read it yourself or wire it into a pipeline. If you prefer a one-off manual look, any browser's developer tools Network tab shows the same response headers, one site at a time.

How much does a security headers audit cost?

$0.01 per run plus $0.02 per URL and $0.01 per flagged issue (capped at 8 per URL). A 10-URL audit at an average of four issues per site costs $0.61; a 100-URL audit costs $6.01. Higher Apify plan tiers discount every event by 10–50%.

Can I check security headers for many sites at once?

Yes — pass as many URLs as you like in a single run. Each is fetched and scored independently, so one unreachable host does not affect the others; that URL just returns a row with status: error and the fetch failure reason.

Why does it say a header is missing when my server sets it?

The auditor reports what a real client receives. Three common causes: a CDN or WAF at the edge strips or rewrites headers before they reach the browser; the header is only set on some routes (you may need to audit https://app.example.com as well as https://example.com); or the site sits behind a login, in which case the auditor only sees the pre-authentication response. Compare with curl -I <url> from the same network to confirm.

Limitations & Honest Notes

• One page per URL. The auditor fetches exactly the URL you provide and inspects the response headers. It does not crawl. To audit multiple pages, pass multiple URLs.
• CDN/WAF headers may differ from origin. A CDN like Cloudflare may add HSTS at the edge even if your origin does not set it. The audit sees what a real client receives.
• CSP quality is heuristic. We detect wildcards, 'unsafe-inline', and 'unsafe-eval', but a full CSP evaluator (Google CSP Evaluator) is out of scope.
• No authenticated scanning. If your app requires a login to reach certain headers, this auditor sees only the pre-authentication response. It sends a fixed descriptive user-agent and no credentials, so there is no custom-UA or cookie input.
• Public data only. The audit reads public response headers — safe for any site. An optional ownership-verification meta tag is supported for ToS compliance.

Data Source

A single polite HTTP GET to each user-supplied URL, using a descriptive user-agent. No scraping of page content, no form submission, no auth. Response headers are the only data extracted.

Support

Found a bug, a false positive, or a missing header check? Use the Issues tab on this actor's Store page — questions and feature requests are welcome there, and feedback on the scoring weights genuinely shapes the next release.

Need a header check this actor does not cover (custom directives, an internal template, a report format your client expects)? Ask on the Issues tab and describe the case.

For the full input and output schema, the HTTP API snippets, and the scheduler, see the API tab on the Store page.