HTTP Security Headers & OWASP Posture Auditor

A security headers checker that audits HTTP response headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, CORP, COEP) for any URL. Returns a 0–100 grade, a letter rating (A–F), and a prioritized fix list with exact header values to add.

A single polite GET per URL — no crawling, no forms, no auth. Built for security teams, DevOps, QA, and agencies who need a fast http security headers check across a portfolio of sites.

What is an HTTP Security Headers Checker?

This actor scans any URL's response headers against OWASP-recommended security controls. Instead of manually inspecting headers or visiting multiple online checkers one site at a time, you submit a list of URLs and get back a scored report with prioritized remediation for each one. Use it programmatically via the Apify API, in CI/CD pipelines, or as a scheduled weekly scan.

Security Headers Checked

Header	What it prevents	Severity if missing
🔴 Content-Security-Policy (CSP)	XSS and data injection — the single most important security header	Critical
🔴 Strict-Transport-Security (HSTS)	SSL-strip MITM; forces HTTPS (RFC 6797)	High
🟠 X-Frame-Options	Clickjacking (DENY / SAMEORIGIN)	Medium
🟠 X-Content-Type-Options	MIME-sniffing XSS (nosniff)	Medium
🟡 Referrer-Policy	Referrer leakage to third parties	Low
🟡 Permissions-Policy	Locks down browser features (camera, mic, geo, payment)	Low
🟡 COOP / CORP / COEP	Cross-origin isolation for Spectre-class security	Low

Each URL gets a 0–100 posture score (A–F grade), issues sorted by severity with a copy-pasteable fix per issue, and a top_fix summary.

Use Cases

• Security & compliance teams — scan your asset inventory weekly to catch missing headers and CSP regressions.
• DevOps / SRE — verify new deployments ship the full OWASP security header set before they hit production.
• Agencies & consultants — generate a prioritized security headers audit report per client site in one run.
• Bug-bounty / recon — quick http header analyzer triage on scoped targets.
• PCI-DSS / SOC 2 — evidence that security headers are present and correctly configured across your perimeter.

Input Example

{
  "urls": ["https://example.com", "https://github.com"]
}

Output Example (per URL)

{
  "url": "https://example.com",
  "http_status": 200,
  "posture_score": 45,
  "posture_grade": "F",
  "https_enabled": true,
  "csp": "missing",
  "hsts": "missing",
  "issue_count": 7,
  "top_fix": "Add: Content-Security-Policy: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'",
  "issues": [
    { "severity": "critical", "area": "CSP", "message": "CSP header is missing…", "fix": "Add: Content-Security-Policy…" },
    { "severity": "high", "area": "HSTS", "message": "HSTS header is missing…", "fix": "Add: Strict-Transport-Security…" }
  ]
}

Pricing (Pay-Per-Event)

Event	Unit	Price
actor-start	per run	$0.01
url-audited	per URL fetched and scored	$0.02
issue-flagged	per issue flagged (capped at 8 per URL)	$0.01

Example cost: 100 URLs × average 4 issues each = $0.01 + (100 × $0.02) + (400 × $0.01) = $6.01 (≈ 6¢ per URL).

Integration

• API / SDK — standard Apify actor; call via HTTP API, JavaScript or Python SDK.
• Schedule — run weekly drift detection; get alerts on grade drops.
• Webhooks — POST results to Make, n8n, or Zapier on completion.
• CI/CD — add to a deploy pipeline; fail the build if posture_grade drops below B.
• Bulk — pass hundreds of URLs; sequential single-request politeness means no rate-limit issues.

Other Apify Actors

• SSL/TLS Certificate Expiry Monitor — monitor certificate expiry, detect changes, and get alerts for any HTTPS domain. Pairs naturally with security headers auditing for a full transport-layer security check.
• Email Deliverability & Domain Posture Auditor — audit SPF, DKIM, DMARC, MTA-STS, and BIMI for any domain. Complete your email security posture alongside HTTP header checks.

Frequently Asked Questions

What are the most important HTTP security headers?

Content-Security-Policy (CSP) and Strict-Transport-Security (HSTS) are the most impactful — CSP is your strongest XSS defense and HSTS prevents SSL-stripping MITM attacks. X-Frame-Options and X-Content-Type-Options are also essential for clickjacking and MIME-sniffing protection. OWASP maintains a Secure Headers Project with a full reference list.

How do I check if my website has security headers?

Pass the URL to this actor. It performs a single GET request and inspects all response headers against the OWASP security headers checklist. You get a scored report with exact fixes for every missing or misconfigured header.

What is the difference between COOP, CORP, and COEP?

Cross-Origin-Opener-Policy (COOP) isolates top-level windows from cross-origin popups. Cross-Origin-Resource-Policy (CORP) controls who can load your resources cross-origin. Cross-Origin-Embedder-Policy (COEP) requires cross-origin isolation for powerful browser features like SharedArrayBuffer. They work together for Spectre-class security.

How do I fix missing HSTS?

Add the Strict-Transport-Security header to your web server or CDN configuration with a max-age of at least one year: Strict-Transport-Security: max-age=31536000; includeSubDomains; preload. This tells browsers to always connect via HTTPS for the specified duration.

What is CSP and why is it critical?

Content-Security-Policy is a browser security mechanism that controls which resources (scripts, styles, images, fonts) a page is allowed to load. A properly configured CSP blocks inline scripts, restricts origins, and is the single most effective defense against cross-site scripting (XSS) attacks. This auditor flags wildcard directives and unsafe patterns ('unsafe-inline', 'unsafe-eval').

Limitations & Honest Notes

• One page per URL. The auditor fetches exactly the URL you provide and inspects the response headers. It does not crawl. To audit multiple pages, pass multiple URLs.
• CDN/WAF headers may differ from origin. A CDN like Cloudflare may add HSTS at the edge even if your origin does not set it. The audit sees what a real client receives.
• CSP quality is heuristic. We detect wildcards, 'unsafe-inline', and 'unsafe-eval', but a full CSP evaluator (Google CSP Evaluator) is out of scope.
• No authenticated scanning. If your app requires login to reach certain headers, this auditor sees only the pre-auth response. Use a custom UA or API-token URL where supported.
• Public data only. The audit reads public response headers — safe for any site. An optional ownership-verification meta tag is supported for ToS compliance.

Data Source

A single polite HTTP GET to each user-supplied URL, using a descriptive user-agent. No scraping of page content, no form submission, no auth. Response headers are the only data extracted.

Support

Found a bug or have a feature request? Open an issue on the GitHub repository or use the Issues tab on the Apify Store page.