HTTP Status and Headers Checker: status codes, redirect chains and security headers for a list of URLs

Paste a list of URLs and get one row per URL with the HTTP status code, every hop of the redirect chain and the final URL, the response time, the Server and Content-Type headers and six security headers that matter most in audits. The Actor sends a single plain GET request per URL, keeps the headers and drops the body, so there are no browsers, no proxies and no stored page content. The table is a regular Apify dataset: download it as JSON, CSV or Excel, or read it through the API.

What it is good for

• Broken link and uptime audits: find 404/410/5xx pages in a sitemap or a list of backlinks.
• Redirect checks after a migration: see every hop (301 → 302 → 200), spot loops and chains longer than one hop, confirm that http:// lands on https://.
• Security header inventory: list which domains send Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy, and which do not.
• Server fingerprinting for SEO or ops: Server and Content-Type of the final response for each URL, plus response time in milliseconds.
• Feeding other tools: the output is flat JSON, one record per input URL, easy to join with your own spreadsheets or to schedule as a monitoring run.

How to use it

1. Open the Actor and paste your list of URLs into the urls field, one per line (or pass a JSON array through the API).
2. Adjust the options if you need them (followRedirects, includeHeaders, timeoutSecs, maxConcurrency); the defaults work for most runs.
3. Click Start. When the run finishes, the status message reads Checked N of M URLs (X with errors, Y invalid).
4. Download the results from the Dataset tab as JSON, CSV or Excel, or read them through the API.

Input

Field	Type	Default	Meaning
urls	array of strings	small self-test list	Absolute URLs starting with http:// or https://. Exact duplicates (same string) are skipped. Up to 1,000 per run (extra entries are dropped and counted in SUMMARY).
followRedirects	boolean	true	Follow up to 10 redirects and report the chain. Set to false to record only the first response.
timeoutSecs	integer 1–60	15	Time limit per URL, including all redirects.
maxConcurrency	integer 1–50	10	How many URLs are checked in parallel.
includeHeaders	boolean	true	Add the full header map of the final response (headers field) to each record.

Example input:

{
  "urls": [
    "https://example.com",
    "http://github.com",
    "https://example.com/does-not-exist"
  ],
  "followRedirects": true,
  "timeoutSecs": 15
}

Output

One JSON record per input URL in the default dataset (nested fields are expanded into columns in the CSV/Excel export). Example (values illustrative, headers shortened):

{
  "url": "http://github.com",
  "finalUrl": "https://github.com/",
  "statusCode": 200,
  "statusText": "OK",
  "ok": true,
  "redirectCount": 1,
  "redirectChain": [
    { "url": "http://github.com/", "statusCode": 301, "location": "https://github.com/" }
  ],
  "responseTimeMs": 184,
  "server": "GitHub.com",
  "contentType": "text/html; charset=utf-8",
  "contentLength": null,
  "securityHeaders": {
    "strictTransportSecurity": "max-age=31536000; includeSubdomains; preload",
    "contentSecurityPolicy": "default-src 'none'; ...",
    "xFrameOptions": "deny",
    "xContentTypeOptions": "nosniff",
    "referrerPolicy": "origin-when-cross-origin, strict-origin-when-cross-origin",
    "permissionsPolicy": null
  },
  "headers": { "content-type": "text/html; charset=utf-8", "server": "GitHub.com" },
  "error": null,
  "errorMessage": null,
  "checkedAt": "2026-09-06T12:00:00.000Z"
}

Field notes:

• url is your input exactly as given (credentials, if any, are masked as user:***@; a user name without a password as ***@; a password containing a raw /, \, ? or # is not recognized as credentials, so percent-encode such characters); finalUrl is always the parser-normalized form of the last URL requested (lower-case scheme and host, trailing slash on a bare host).
• ok is true only for a final status in the 2xx range.
• statusCode is null when no final response was received (timeout or network error); hops that were already followed stay in redirectChain. Look at error then.
• error is one of INVALID_URL, TIMEOUT, NETWORK_ERROR, TOO_MANY_REDIRECTS, or null on success. errorMessage carries the detail (for example the DNS error text). With TOO_MANY_REDIRECTS the record still carries the status and headers of the last 3xx response.
• INVALID_URL (never charged) covers: anything that is not an absolute http(s):// URL; URLs with embedded credentials (https://user:pass@host/); ports that the Fetch standard refuses to connect to (for example 22, 25, 53, 6000, 10080); and private, loopback, link-local or localhost addresses (127.0.0.1, 10.x, 192.168.x, 169.254.x, localhost, [::1], …). The Actor checks publicly reachable URLs only. Note that a public host name that resolves to a private address is not detected.
• Redirects to anything other than a public http(s):// target (for example data:, ftp: or a private address) are not followed; the 3xx response is recorded as the final one.
• responseTimeMs covers the whole redirect chain, from the first request to the final response; checkedAt is the time the check started.
• contentLength is the Content-Length of the final response as sent to this client. Requests advertise Accept-Encoding: gzip, deflate, so servers that compress report the compressed size (null for chunked responses).
• securityHeaders values are the raw header strings; null means the server did not send that header.
• Header names in headers are lower-cased. Set-Cookie headers are dropped on purpose: cookie values are session identifiers and the Actor does not collect them.

A SUMMARY record is saved to the run's key-value store: inputEntries (rows you provided), inputUrls (after trimming, de-duplication and the 1,000 cap), skippedDuplicates, droppedEmptyOrNonString, truncatedOverLimit, processed, checked, failed, invalid, notSavedAfterLimit, unexpectedErrors, stoppedByChargeLimit. The run's status message repeats the key numbers (for example Checked 7 of 7 URLs (2 with errors, 1 invalid)).

Pricing

This Actor uses Apify pay per event pricing. Each run costs a small fixed start fee plus a price per URL checked; the exact amounts are shown in the Pricing tab. A URL is charged when it was actually requested (timeouts and network errors count, because a request was made). Invalid entries (error = "INVALID_URL", see field notes) are written to the dataset but are not charged. There are no additional platform usage fees.

If you set a maximum total charge for the run, the Actor stops when the budget is reached, finishes successfully and says in its status message how many URLs were checked; the remaining URLs are not requested. A limit lower than one Actor start plus one URL makes the run fail immediately with an explanatory message. If the platform migrates the run to another server, the Actor resumes from its saved state, URLs already saved are not checked or charged again.

Limits and behavior

• Up to 1,000 URLs per run; up to 10 redirects per URL; timeout 1–60 seconds per URL.
• Requests are sent from Apify's shared infrastructure without proxies. Some servers answer 403 or 429 to automated clients; that is reported as a normal result, not retried.
• The Actor sends a descriptive User-Agent (GridlineTools-HTTPStatusChecker) so site owners can identify it.
• Response bodies are never downloaded, stored or parsed. Only response metadata is saved.
• No login, cookies or JavaScript execution: pages behind authentication return whatever the server sends to an anonymous request.

FAQ

Does it follow meta refresh or JavaScript redirects? No. Only HTTP redirects (301, 302, 303, 307, 308 with a Location header) are followed.

Why do I see 403 for a site that opens fine in my browser? The site blocks automated clients or requires cookies. The status you get is exactly what the server returned to a plain request, useful information in itself.

Can I check the same list every day? Yes, schedule the Actor in Apify Console and download the dataset, or connect a webhook to your own system.

Is the order of results the same as the input? Records are written as checks finish (parallel processing). Each record carries the original url, so you can sort or join on it.

What counts as one "URL checked"? One input URL, regardless of how many redirects it took to reach the final response. Timeouts and network errors do count (the request was made); invalid URLs (including private addresses and blocked ports) do not.

Can I check servers on my own network or on localhost? No. The Actor runs in Apify's cloud and only checks publicly reachable addresses; private, loopback and link-local addresses are rejected as INVALID_URL without a request.

Other Actors by Gridline Tools

Other checks from the same publisher, each with one row per address and the same pricing rule (start fee plus price per checked item):

• Robots.txt Checker: Test a list of URLs against each site's robots.txt for a chosen user agent (RFC 9309).
• RDAP Domain Lookup and Expiry Checker: Query RDAP registries for a list of domains and get registrar, creation and expiry dates, EPP statuses, name servers and DNSSEC in one table.
• AI Crawler Access Audit: See which AI and search crawlers (GPTBot, ClaudeBot, Google-Extended, CCBot and 150+ more) each site allows or blocks in robots.txt, and whether llms.txt is published.

Disclaimer

This Actor provides technical metadata about publicly reachable URLs. You are responsible for making sure that your use complies with applicable law and with the terms of service of the sites you check. The Actor comes without any availability guarantee. Output data is provided as-is for your own use; it does not contain personal data by design (cookies are never stored and credentials in URLs are masked).