Pricing

from $20.00 / 1,000 url auditeds

HTTP Security Headers & OWASP Posture Auditor

Audit HTTP security response headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP) for any URL. Returns a 0-100 grade, letter rating, and a prioritized fix list with exact header values to add. Single polite GET per URL, no crawling.

Pricing

from $20.00 / 1,000 url auditeds

Rating

0.0

(0)

Developer

Geo

Actor stats

Bookmarked

Total users

Monthly active users

2 days ago

Last modified

Categories

Developer tools

Automation

You can access the HTTP Security Headers & OWASP Posture Auditor programmatically from your own applications by using the Apify API. You can also choose the language preference from below. To use the Apify API, you’ll need an Apify account and your API token, found in Integrations settings in Apify Console.

Python

JavaScript

CLI

OpenAPI

HTTP

MCP

1from apify_client import ApifyClient
2
3# Initialize the ApifyClient with your Apify API token
4# Replace '<YOUR_API_TOKEN>' with your token.
5client = ApifyClient("<YOUR_API_TOKEN>")
6
7# Prepare the Actor input
8run_input = { "urls": ["https://example.com"] }
9
10# Run the Actor and wait for it to finish
11run = client.actor("gp005/security-headers-auditor").call(run_input=run_input)
12
13# Fetch and print Actor results from the run's dataset (if there are any)
14print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"])
15for item in client.dataset(run["defaultDatasetId"]).iterate_items():
16    print(item)
17
18# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

HTTP Security Headers & OWASP Posture Auditor API in Python

The Apify API client for Python is the official library that allows you to use HTTP Security Headers & OWASP Posture Auditor API in Python, providing convenience functions and automatic retries on errors.

Install the apify-client

$pip install apify-client

Other API clients include:

HTTP Security Headers & OWASP Posture Auditor API in JavaScript

HTTP Security Headers & OWASP Posture Auditor API through CLI

HTTP Security Headers & OWASP Posture Auditor OpenAPI definition

HTTP Security Headers & OWASP Posture Auditor API

🛡️ Security Headers Checker

taroyamada/security-headers-checker

Audit HTTP security headers in bulk across hundreds of websites. Extract OWASP compliance grades and detect missing HSTS or CSP directives instantly.

naoki anzai

HTTP Security Headers Analyzer

andok/security-headers-analyzer

Audit HTTP response headers (CSP, HSTS, X-Frame-Options) to verify web application security and compliance standards.

Andok

Security Headers Checker — OWASP Audit & Grading

accurate_pouch/security-headers

Audit 12 HTTP security headers (HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP, CORP, COEP). A-F grading, actionable recommendations. 5 URLs free.

Manchitt Sanan

Bulk HTTP Security Headers Analyzer - CSP, HSTS

logiover/bulk-http-security-headers

Analyze HTTP security headers for thousands of URLs. Checks CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and more. Returns pass/fail per header plus a numeric security score. No API key, export to CSV/JSON. Ideal for security audits and compliance scanning.

Logiover

Website Tech Stack Detector — 100+ Technologies

ryanclinton/website-tech-stack-detector

Identify the technologies, frameworks, and services running on any website. Website Tech Stack Detector crawls one or more URLs, inspects HTTP headers, HTML meta tags, script sources, and body content, then matches them against a fingerprint database of 106 web technologies across 17 categories.

Ryan Clinton

Tech Stack Detector — Bulk Website Technology Lookup

accurate_pouch/tech-stack-detector

Detect frameworks, CMS, analytics, CDN, hosting, chat tools, and more for any list of URLs. No API key needed — reads public HTTP headers and HTML.

Manchitt Sanan

SSL/TLS Certificate Scraper

taroyamada/ssl-certificate-monitor

Scan thousands of websites for expiring TLS certs, extract fingerprint hashes, and run Google Web Risk malware checks without rendering a browser.

naoki anzai

HTTP Probe -- TLS, Security Headers, Redirects

jungle_synthesizer/ssl-security-headers-checker

Bulk site-health probe: TLS certificate, security-header grading (CSP, HSTS, X-Frame-Options, Permissions-Policy + 5 others, A/B/C/D/F grade), redirect chain, TTFB, HTTP/2 + HTTP/3, IPv6 reachability. Built for devops, security, and CI pipelines.

BowTiedRaccoon

GSA Site Scanning Scraper — US Federal Website Inventory

compute-edge/gsa-site-scanning-scraper

Extract the GSA Site Scanning inventory of U.S. federal government websites — tech stack, security headers, HTTPS/HSTS posture, USWDS design-system usage, DAP analytics presence, and more. Filter by agency, base domain, or status code.

Compute Edge

Company Domain Tech, DNS & Security Audit

taroyamada/company-enrichment-intelligence

Turn company domains into structured website, tech stack, DNS, SPF, DMARC, RDAP, TLS certificate, robots.txt, and sitemap audit records. Public, keyless sources only: the company's own website plus public registries. Pay per audited domain.

naoki anzai

SSL Certificate Checker

automation-lab/ssl-certificate-checker

SSL Certificate Checker connects to domains over TLS and inspects their SSL certificates. It returns structured data about certificate validity, expiry, issuer chain, TLS protocol version, cipher suite, and a security grade from A+ to F.