# Website Security Headers & TLS Audit (`helveticlabs/security-audit`) Actor

Grade any website's security from A+ to F: HTTPS redirect, HSTS, CSP, clickjacking protection, cookie flags, TLS certificate expiry, security.txt and e-mail spoofing protection (SPF, DMARC). Passive and polite.

- **URL**: https://apify.com/helveticlabs/security-audit.md
- **Developed by:** [Helvetic Labs](https://apify.com/helveticlabs) (community)
- **Categories:** Developer tools, SEO tools, Automation
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $10.00 / 1,000 domain auditeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Website Security Headers & TLS Audit

Grade the security of any number of websites from **A+ to F** in one run, with a fix for
every finding. The audit is passive: it looks at what every browser and mail server can
see, nothing more.

### What it checks

**Web (graded 0 to 100):**

- HTTPS works with a valid certificate, and HTTP redirects to HTTPS
- `Strict-Transport-Security` (HSTS): present, long enough, includeSubDomains, preload
- `Content-Security-Policy`: present, and whether it still allows inline scripts
- Clickjacking protection: CSP `frame-ancestors` or `X-Frame-Options`
- `X-Content-Type-Options: nosniff`, `Referrer-Policy`, `Permissions-Policy`
- Cookie flags: how many cookies lack `Secure`, `HttpOnly` or `SameSite`
- Software versions disclosed in `Server` or `X-Powered-By`
- TLS version, certificate issuer and expiry date (days left)
- `security.txt` (RFC 9116) with Contact and a valid Expires date

**E-mail spoofing protection (scored separately):**

- SPF: present, a single record, and how it ends (`-all`, `~all`)
- DMARC: present and its policy (`none`, `quarantine`, `reject`), for subdomains also the policy they inherit from the parent domain
- MX records and CAA records (which certificate authorities may issue)

### How it works

Per domain it requests the home page over HTTPS and over HTTP (headers only), the
`security.txt` file, makes one TLS handshake and a few DNS lookups. No port scans, no
path probing, no load on the site. It respects `robots.txt`.

The results contain flags, dates and counts only. They never contain cookie names or
values, e-mail addresses from DMARC records or security.txt contacts.

### Input

```json
{
  "domains": ["example.com", "https://www.example.org/"],
  "checkEmailDns": true,
  "timeoutSecs": 15
}
```

### Output

One item per domain (shortened):

```json
{
  "domain": "example.com",
  "grade": "B",
  "score": 75,
  "email_score": 80,
  "https": {"ok": true, "status": 200, "final_url": "https://example.com/"},
  "http_to_https": true,
  "tls": {"ok": true, "version": "TLSv1.3", "issuer": "Let's Encrypt", "valid_until": "2027-01-05", "days_left": 79},
  "headers": {"hsts": {"present": true, "max_age": 31536000, "include_subdomains": true, "preload": false}},
  "cookies": {"count": 2, "without_secure": 0, "without_httponly": 1, "without_samesite": 1},
  "email": {"spf": {"present": true, "all": "-all"}, "dmarc": {"present": true, "policy": "quarantine"}},
  "findings": [
    {"check": "csp", "status": "fail", "detail": "No Content-Security-Policy header.", "fix": "Add a Content-Security-Policy, starting with default-src 'self'."}
  ]
}
```

### Grades

| Score | Grade |
| --- | --- |
| 95 and more (with HSTS includeSubDomains) | A+ |
| 85 to 94 | A |
| 70 to 84 | B |
| 55 to 69 | C |
| 40 to 54 | D |
| below 40, or no working HTTPS | F |

### Pricing

You pay per domain audited. Inputs that are not a public domain are listed free of charge.
Set a maximum cost for the run, and the audit stops at your limit.

### Use cases

Agencies checking client sites, security teams watching their domains and suppliers,
developers checking a release, and monitoring certificate expiry on a schedule.

### Use it from code or AI agents

Run it through the Apify API, schedule it daily, connect it to Make, Zapier or n8n, or call
it from AI agents through Apify's MCP server.

### Note

The grade is a quick, automated view of common best practices, not a penetration test or a
compliance certificate. Audit only domains you are allowed to check.

### Provider, privacy and fair use

**Provider:** HelveticLabs, sole proprietorship of Marvin Krieg, c/o SwissMailBox 170,
12 Rue Le Corbusier, 1208 Genève, Switzerland. E-mail: contact@helveticlabs.org.
Imprint: https://www.helveticlabs.org/imprint

**Privacy:** This Actor runs on the Apify platform, in your Apify account. It processes only
the URLs or domains you enter and the public technical data the checked servers return
(status codes, headers, certificates, DNS records, sitemap URLs, links). It does not collect
personal data: it never stores or returns page text (where a page's HTML is read, it is read
in memory only, to find links and measure tags), and it leaves out e-mail addresses, cookie
names and values and similar values. Your input and results stay in your Apify account and are
stored by Apify under its own terms (https://apify.com/privacy-policy). The provider sees
only the usage statistics Apify shows to Actor authors (such as the number of users and
runs), not your input or results, unless you share a run for support. Questions about
privacy: contact@helveticlabs.org.

**Fair use:** Check only sites you own or may check. Do not use the results to attack
systems or people. The Actor respects robots.txt, identifies itself, and keeps a polite
pace per site.

**No warranty:** The results are automated checks and can be incomplete. They are not a
penetration test, legal advice or a compliance certificate.

# Actor input Schema

## `domains` (type: `array`):

Domains (example.com) or URLs (https://www.example.com/page). The home page of each host is audited.

## `checkEmailDns` (type: `boolean`):

Also check whether the domain is protected against e-mail spoofing.

## `timeoutSecs` (type: `integer`):

How long to wait for each response.

## Actor input object example

```json
{
  "domains": [
    "example.com"
  ],
  "checkEmailDns": true,
  "timeoutSecs": 15
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "example.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("helveticlabs/security-audit").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domains": ["example.com"] }

# Run the Actor and wait for it to finish
run = client.actor("helveticlabs/security-audit").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "example.com"
  ]
}' |
apify call helveticlabs/security-audit --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,helveticlabs/security-audit"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/OAkcImxprsV3cxRzJ/builds/vGzGPULVEbXOUcjlb/openapi.json