Website Security Headers & TLS Audit

Grade the security of any number of websites from A+ to F in one run, with a fix for every finding. The audit is passive: it looks at what every browser and mail server can see, nothing more.

What it checks

Web (graded 0 to 100):

• HTTPS works with a valid certificate, and HTTP redirects to HTTPS
• Strict-Transport-Security (HSTS): present, long enough, includeSubDomains, preload
• Content-Security-Policy: present, and whether it still allows inline scripts
• Clickjacking protection: CSP frame-ancestors or X-Frame-Options
• X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy
• Cookie flags: how many cookies lack Secure, HttpOnly or SameSite
• Software versions disclosed in Server or X-Powered-By
• TLS version, certificate issuer and expiry date (days left)
• security.txt (RFC 9116) with Contact and a valid Expires date

E-mail spoofing protection (scored separately):

• SPF: present, a single record, and how it ends (-all, ~all)
• DMARC: present and its policy (none, quarantine, reject), for subdomains also the policy they inherit from the parent domain
• MX records and CAA records (which certificate authorities may issue)

How it works

Per domain it requests the home page over HTTPS and over HTTP (headers only), the security.txt file, makes one TLS handshake and a few DNS lookups. No port scans, no path probing, no load on the site. It respects robots.txt.

The results contain flags, dates and counts only. They never contain cookie names or values, e-mail addresses from DMARC records or security.txt contacts.

Input

{
  "domains": ["example.com", "https://www.example.org/"],
  "checkEmailDns": true,
  "timeoutSecs": 15
}

Output

One item per domain (shortened):

{
  "domain": "example.com",
  "grade": "B",
  "score": 75,
  "email_score": 80,
  "https": {"ok": true, "status": 200, "final_url": "https://example.com/"},
  "http_to_https": true,
  "tls": {"ok": true, "version": "TLSv1.3", "issuer": "Let's Encrypt", "valid_until": "2027-01-05", "days_left": 79},
  "headers": {"hsts": {"present": true, "max_age": 31536000, "include_subdomains": true, "preload": false}},
  "cookies": {"count": 2, "without_secure": 0, "without_httponly": 1, "without_samesite": 1},
  "email": {"spf": {"present": true, "all": "-all"}, "dmarc": {"present": true, "policy": "quarantine"}},
  "findings": [
    {"check": "csp", "status": "fail", "detail": "No Content-Security-Policy header.", "fix": "Add a Content-Security-Policy, starting with default-src 'self'."}
  ]
}

Grades

Score	Grade
95 and more (with HSTS includeSubDomains)	A+
85 to 94	A
70 to 84	B
55 to 69	C
40 to 54	D
below 40, or no working HTTPS	F

Pricing

You pay per domain audited. Inputs that are not a public domain are listed free of charge. Set a maximum cost for the run, and the audit stops at your limit.

Use cases

Agencies checking client sites, security teams watching their domains and suppliers, developers checking a release, and monitoring certificate expiry on a schedule.

Use it from code or AI agents

Run it through the Apify API, schedule it daily, connect it to Make, Zapier or n8n, or call it from AI agents through Apify's MCP server.

Note

The grade is a quick, automated view of common best practices, not a penetration test or a compliance certificate. Audit only domains you are allowed to check.

Provider, privacy and fair use

Provider: HelveticLabs, sole proprietorship of Marvin Krieg, c/o SwissMailBox 170, 12 Rue Le Corbusier, 1208 Genève, Switzerland. E-mail: contact@helveticlabs.org. Imprint: https://www.helveticlabs.org/imprint

Privacy: This Actor runs on the Apify platform, in your Apify account. It processes only the URLs or domains you enter and the public technical data the checked servers return (status codes, headers, certificates, DNS records, sitemap URLs, links). It does not collect personal data: it never stores or returns page text (where a page's HTML is read, it is read in memory only, to find links and measure tags), and it leaves out e-mail addresses, cookie names and values and similar values. Your input and results stay in your Apify account and are stored by Apify under its own terms (https://apify.com/privacy-policy). The provider sees only the usage statistics Apify shows to Actor authors (such as the number of users and runs), not your input or results, unless you share a run for support. Questions about privacy: contact@helveticlabs.org.

Fair use: Check only sites you own or may check. Do not use the results to attack systems or people. The Actor respects robots.txt, identifies itself, and keeps a polite pace per site.

No warranty: The results are automated checks and can be incomplete. They are not a penetration test, legal advice or a compliance certificate.