# HTTP Probe -- TLS, Security Headers, Redirects (`jungle_synthesizer/ssl-security-headers-checker`) Actor Bulk site-health probe: TLS certificate, security-header grading (CSP, HSTS, X-Frame-Options, Permissions-Policy + 5 others, A/B/C/D/F grade), redirect chain, TTFB, HTTP/2 + HTTP/3, IPv6 reachability. Built for devops, security, and CI pipelines. - **URL**: https://apify.com/jungle\_synthesizer/ssl-security-headers-checker.md - **Developed by:** [BowTiedRaccoon](https://apify.com/jungle_synthesizer) (community) - **Categories:** Developer tools, Automation - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, NaN bookmarks - **User rating**: No ratings yet ## Pricing Pay per event This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-event ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## SSL & Security Headers Checker (HTTP Probe) Bulk site-health probe in a single record per URL: TLS certificate, security-header grade (A+ through F), redirect chain, TTFB, HTTP/2 and HTTP/3 negotiation, and IPv6 reachability. Pure Node, no browser, no proxies. --- ### SSL & Security Headers Features - TLS certificate capture: issuer, subject, validity window, daysToExpiry, signature algorithm, SAN list, serial number, OCSP stapling. - Security-header grading modeled after securityheaders.com — A+ / A / B / C / D / F across the standard nine (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP, CORP). - Lists every missing header so you can hand the row to a developer and say "this". - Full redirect-chain capture (up to 10 hops) with status codes and from/to. - HTTP/2 detection via ALPN, HTTP/3 detection via the Alt-Svc header. - Optional IPv6 reachability probe — resolves AAAA, opens a `family:6` TLS connection, records the boolean. - Bare hosts auto-prefix to `https://`. Duplicates are removed before probing. --- ### Who Uses Site Health Probe Data? - **DevOps and SRE** — track SSL expiry windows across portfolios so a forgotten cert never takes a service down. - **Security teams** — audit CSP, HSTS, and frame-ancestors posture across thousands of subdomains in one run. - **CI pipelines** — fail a build when a deployment regresses on security headers or HTTPS posture. - **Penetration testers** — bulk-fingerprint TLS, HTTP/2, HTTP/3, and IPv6 surface area before a deeper engagement. - **Compliance auditors** — produce evidence of TLS hygiene across a portfolio without writing a custom probe each quarter. --- ### How HTTP Probe Works 1. Pass in a list of URLs (or bare hosts; they auto-prefix to `https://`). Duplicates are dropped. 2. For each URL the actor runs a TLS handshake (with ALPN h2 negotiation), then issues an HTTP request — preferring HTTP/2 when negotiated, falling back to HTTP/1.1. 3. If `followRedirects` is on, every hop is captured and walked up to 10 levels with cycle detection. 4. The header grader checks the configured set, computes the A+ through F grade, and the row also records HTTP/3 (Alt-Svc) and optional IPv6 reachability. --- ### Input ```json { "urls": ["https://example.com/", "https://github.com/", "https://cloudflare.com/"], "maxItems": 5, "followRedirects": true, "checkHeaders": [ "content-security-policy", "strict-transport-security", "x-frame-options", "x-content-type-options", "referrer-policy", "permissions-policy", "cross-origin-opener-policy", "cross-origin-embedder-policy", "cross-origin-resource-policy" ], "runIPv6": false, "timeoutSec": 15, "concurrency": 25 } ```` | Field | Type | Default | Description | |-------|------|---------|-------------| | `urls` | array | required | URLs (`https://example.com/`) or bare hosts (`example.com`). Bare hosts auto-prefix to `https://`. | | `maxItems` | integer | 5 | Cap on URLs probed after dedup. Range 1-10000. | | `followRedirects` | boolean | true | Follow up to 10 redirects and log each hop. | | `checkHeaders` | array | the standard nine | Security headers to grade. | | `runIPv6` | boolean | false | Probe IPv6 (AAAA + `family:6` TLS connect). Records `ipv6Reachable`. | | `timeoutSec` | integer | 15 | Per-URL HTTP timeout in seconds. Range 3-60. | | `concurrency` | integer | 25 | Parallel probes. Hard cap at 50 to avoid socket exhaustion. | *** ### SSL & Security Headers Output Fields ```json { "url": "https://cloudflare.com/", "finalUrl": "https://www.cloudflare.com/", "status": 200, "redirectChain": ["301 https://cloudflare.com/ -> https://www.cloudflare.com/"], "ttfbMs": 142, "totalMs": 487, "ssl": { "subject": "Cloudflare, Inc. / cloudflare.com", "issuer": "Google Trust Services / WE1", "validFrom": "2026-03-12T20:59:51.000Z", "validTo": "2026-06-10T21:59:46.000Z", "daysToExpiry": 41, "sigAlg": "prime256v1", "sans": ["cloudflare.com", "*.cloudflare.com"], "serialNumber": "AABBCC", "ocspStapling": true }, "headers": { "raw": { "strict-transport-security": "max-age=63072000; includeSubDomains; preload", "content-security-policy": "default-src 'self'" }, "missingSecurity": ["cross-origin-embedder-policy"], "gradeApprox": "B" }, "http2": true, "http3": true, "ipv6Reachable": false, "probedAt": "2026-04-30T12:00:00.000Z", "error": "" } ``` | Field | Type | Description | |-------|------|-------------| | `url` | string | Probed URL (input). | | `finalUrl` | string | URL after redirects (same as `url` when none followed). | | `status` | number | HTTP status code of the final response. | | `redirectChain` | array | Ordered list of hops as `'STATUS from -> to'` strings. | | `ttfbMs` | number | Time to first byte in ms. | | `totalMs` | number | Total elapsed time in ms (TLS + request + body). | | `ssl` | object | issuer, subject, validFrom, validTo, daysToExpiry, sigAlg, sans, serialNumber, ocspStapling. | | `headers` | object | `{raw, missingSecurity, gradeApprox}`. | | `http2` | boolean | True when the server negotiated HTTP/2 via ALPN. | | `http3` | boolean | True when the server advertises HTTP/3 via Alt-Svc. | | `ipv6Reachable` | boolean | True when the IPv6 probe connected (only meaningful when `runIPv6=true`). | | `probedAt` | string | ISO timestamp when the probe completed. | | `error` | string | Error message on failure (empty on success). | #### Grade rules - **A+** — every wanted header present, HSTS includes `preload`, HSTS `max-age >= 1 year`, CSP defined and free of `unsafe-inline` / `unsafe-eval`. - **A** — every wanted header present, no A+ bonus. - **B** — 7-8 of 9 present. - **C** — 5-6 present. - **D** — 3-4 present. - **F** — fewer than 3 present, or no headers received at all. *** ### Pricing Two events. Basic probes are cheap. Full audits — `runIPv6=true` AND `followRedirects=true` AND the full standard nine headers graded — bill at the premium rate because they spend more time on the wire. | Event | Price | |-------|-------| | Actor start | $0.10 | | Basic probe | $0.002 | | Full audit | $0.004 | | Volume | Basic | Full audit | |--------|-------|-----------| | 100 URLs | $0.30 | $0.50 | | 1,000 URLs | $2.10 | $4.10 | | 10,000 URLs | $20.10 | $40.10 | *** ### Limits - `maxItems` caps at 10,000 per run. - The Apify console tester has a 5-minute timeout — keep `maxItems` low (default 5) for in-browser testing. - `concurrency` caps at 50 to avoid socket exhaustion on the runner. - TLS handshake timeout is fixed at 8 seconds. HTTP request timeout defaults to 15 s, max 60 s. - Up to 10 redirects per URL; cycles are detected via the visited-set and short-circuited. - IPv6 reachability is opt-in. Many runners have IPv6 disabled at the host level — if you need definitive IPv6 results, run on a runner you control. *** ### Related Actors - **DNS Domain Audit** — pair for full DNS + WHOIS + email-auth + TLS posture per domain. - **Sitemap Walker Pro** — discover URLs across a site, then probe each one. - **Structured Data Validator Pro** — combine for SEO + security audits in the same run. *** ### Need More Features? Useful queued additions: TLS cipher details, certificate-chain depth, HSTS preload-list lookup, CT-log SCT count, MTA-STS / TLS-RPT, BIMI, CAA enforcement check. [File an issue](https://console.apify.com/actors/issues) to vote one up. ### Why Use SSL & Security Headers Checker? - **One row, full picture** — TLS, headers, redirects, HTTP/2/3, IPv6, and timings in a single record. Sortable, filterable, and ready for a dashboard. - **Cheap at scale** — $0.002 per basic probe. 10,000 sites for $20 puts the spreadsheet you've been maintaining out of business. - **No browser** — pure Node sockets. Faster, cheaper, and less brittle than driving a Chromium for what is, fundamentally, a TLS handshake and a HEAD request. *** Built by [OrbTop](https://orbtop.com). # Actor input Schema ## `sp_intended_usage` (type: `string`): Please describe how you plan to use the data extracted by this crawler. ## `sp_improvement_suggestions` (type: `string`): Provide any feedback or suggestions for improvements. ## `sp_contact` (type: `string`): Provide your email address so we can get in touch with you. ## `urls` (type: `array`): List of URLs to probe (e.g. https://example.com/). Bare hosts are auto-prefixed with https://. ## `maxItems` (type: `integer`): Cap on the number of URLs probed (after deduplication). Default 5; raise for larger batches. ## `followRedirects` (type: `boolean`): Follow up to 10 redirects and log each hop (from, to, status). ## `checkHeaders` (type: `array`): Security headers to grade. Defaults to the standard nine (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP, CORP). ## `runIPv6` (type: `boolean`): Additionally probe via IPv6 (AAAA + family:6 connect). Records ipv6Reachable boolean per URL. ## `timeoutSec` (type: `integer`): Hard timeout for the HTTPS request portion of each probe. TLS handshake has a separate 8s cap. ## `concurrency` (type: `integer`): Parallel probes. Cap at 50 to avoid socket exhaustion. ## Actor input object example ```json { "sp_intended_usage": "Describe your intended use...", "sp_improvement_suggestions": "Share your suggestions here...", "sp_contact": "Share your email here...", "urls": [ "https://example.com/", "https://github.com/", "https://cloudflare.com/" ], "maxItems": 5, "followRedirects": true, "checkHeaders": [ "content-security-policy", "strict-transport-security", "x-frame-options", "x-content-type-options", "referrer-policy", "permissions-policy", "cross-origin-opener-policy", "cross-origin-embedder-policy", "cross-origin-resource-policy" ], "runIPv6": false, "timeoutSec": 15, "concurrency": 25 } ``` # Actor output Schema ## `results` (type: `string`): No description # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "sp_intended_usage": "Describe your intended use...", "sp_improvement_suggestions": "Share your suggestions here...", "sp_contact": "Share your email here...", "urls": [ "https://example.com/", "https://github.com/", "https://cloudflare.com/" ], "maxItems": 5, "followRedirects": true, "checkHeaders": [ "content-security-policy", "strict-transport-security", "x-frame-options", "x-content-type-options", "referrer-policy", "permissions-policy", "cross-origin-opener-policy", "cross-origin-embedder-policy", "cross-origin-resource-policy" ], "runIPv6": false, "timeoutSec": 15, "concurrency": 25 }; // Run the Actor and wait for it to finish const run = await client.actor("jungle_synthesizer/ssl-security-headers-checker").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "sp_intended_usage": "Describe your intended use...", "sp_improvement_suggestions": "Share your suggestions here...", "sp_contact": "Share your email here...", "urls": [ "https://example.com/", "https://github.com/", "https://cloudflare.com/", ], "maxItems": 5, "followRedirects": True, "checkHeaders": [ "content-security-policy", "strict-transport-security", "x-frame-options", "x-content-type-options", "referrer-policy", "permissions-policy", "cross-origin-opener-policy", "cross-origin-embedder-policy", "cross-origin-resource-policy", ], "runIPv6": False, "timeoutSec": 15, "concurrency": 25, } # Run the Actor and wait for it to finish run = client.actor("jungle_synthesizer/ssl-security-headers-checker").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "sp_intended_usage": "Describe your intended use...", "sp_improvement_suggestions": "Share your suggestions here...", "sp_contact": "Share your email here...", "urls": [ "https://example.com/", "https://github.com/", "https://cloudflare.com/" ], "maxItems": 5, "followRedirects": true, "checkHeaders": [ "content-security-policy", "strict-transport-security", "x-frame-options", "x-content-type-options", "referrer-policy", "permissions-policy", "cross-origin-opener-policy", "cross-origin-embedder-policy", "cross-origin-resource-policy" ], "runIPv6": false, "timeoutSec": 15, "concurrency": 25 }' | apify call jungle_synthesizer/ssl-security-headers-checker --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=jungle_synthesizer/ssl-security-headers-checker", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "HTTP Probe -- TLS, Security Headers, Redirects", "description": "Bulk site-health probe: TLS certificate, security-header grading (CSP, HSTS, X-Frame-Options, Permissions-Policy + 5 others, A/B/C/D/F grade), redirect chain, TTFB, HTTP/2 + HTTP/3, IPv6 reachability. Built for devops, security, and CI pipelines.", "version": "1.0", "x-build-id": "sYmeZl11Z1vseqahj" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/jungle_synthesizer~ssl-security-headers-checker/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-jungle_synthesizer-ssl-security-headers-checker", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/jungle_synthesizer~ssl-security-headers-checker/runs": { "post": { "operationId": "runs-sync-jungle_synthesizer-ssl-security-headers-checker", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/jungle_synthesizer~ssl-security-headers-checker/run-sync": { "post": { "operationId": "run-sync-jungle_synthesizer-ssl-security-headers-checker", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "sp_intended_usage", "sp_improvement_suggestions", "urls" ], "properties": { "sp_intended_usage": { "title": "What is the intended usage of this data?", "minLength": 1, "type": "string", "description": "Please describe how you plan to use the data extracted by this crawler." }, "sp_improvement_suggestions": { "title": "How can we improve this crawler for you?", "minLength": 1, "type": "string", "description": "Provide any feedback or suggestions for improvements." }, "sp_contact": { "title": "Contact Email", "minLength": 1, "type": "string", "description": "Provide your email address so we can get in touch with you." }, "urls": { "title": "URLs", "type": "array", "description": "List of URLs to probe (e.g. https://example.com/). Bare hosts are auto-prefixed with https://.", "items": { "type": "string" } }, "maxItems": { "title": "Max Items", "minimum": 1, "maximum": 10000, "type": "integer", "description": "Cap on the number of URLs probed (after deduplication). Default 5; raise for larger batches.", "default": 5 }, "followRedirects": { "title": "Follow Redirects", "type": "boolean", "description": "Follow up to 10 redirects and log each hop (from, to, status).", "default": true }, "checkHeaders": { "title": "Headers To Check", "type": "array", "description": "Security headers to grade. Defaults to the standard nine (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP, CORP).", "items": { "type": "string" } }, "runIPv6": { "title": "Probe IPv6", "type": "boolean", "description": "Additionally probe via IPv6 (AAAA + family:6 connect). Records ipv6Reachable boolean per URL.", "default": false }, "timeoutSec": { "title": "Per-URL Timeout (seconds)", "minimum": 3, "maximum": 60, "type": "integer", "description": "Hard timeout for the HTTPS request portion of each probe. TLS handshake has a separate 8s cap.", "default": 15 }, "concurrency": { "title": "Concurrency", "minimum": 1, "maximum": 50, "type": "integer", "description": "Parallel probes. Cap at 50 to avoid socket exhaustion.", "default": 25 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```