Pricing

from $4.90 / 1,000 url auditeds

Go to Apify Store

Security Headers Auditor

Try for free

Audit website security headers such as CSP, HSTS, X-Frame-Options, Referrer-Policy, and Permissions-Policy.

Pricing

from $4.90 / 1,000 url auditeds

Rating

0.0

(0)

Developer

junipr

Actor stats

Bookmarked

Total users

Monthly active users

9 days ago

Last modified

Categories

Developer tools

Header Targets

targets

Optional

Header snapshots to audit. Defaults to a small hardened fixture that finishes quickly.

Type:object[]

Default:

[
  {
    "sourceId": "sample-hardened-site",
    "sourceUrl": "https://example.com",
    "statusCode": 200,
    "headers": {
      "strict-transport-security": "max-age=31536000; includeSubDomains; preload",
      "content-security-policy": "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'",
      "x-frame-options": "DENY",
      "x-content-type-options": "nosniff",
      "referrer-policy": "strict-origin-when-cross-origin",
      "permissions-policy": "geolocation=(), microphone=(), camera=()",
      "cross-origin-opener-policy": "same-origin",
      "cross-origin-resource-policy": "same-origin"
    },
    "previousHeaders": {
      "strict-transport-security": "max-age=86400",
      "x-content-type-options": "nosniff"
    }
  }
]

URLs To Fetch

urls

Optional

Optional URLs to fetch only when fetchUrls is true. Leave empty for fixture/local runs.

Type:string[]

Default:

[]

Fetch URLs

fetchUrls

Optional

Fetch headers over HTTP. Default is false to keep zero-config runs local and cheap.

Type:boolean

Default:false

Compare Previous Headers

comparePrevious

Optional

Compare previousHeaders against current headers when available.

Type:boolean

Default:true

Max Items

maxItems

Optional

Alias for Max Targets/Maximum Records used by the Junipr actor baseline. When both are provided, actor-specific limits still apply.

Type:integer

Minimum:1

Maximum:250

Default:25

Include Report Artifacts

includeReport

Optional

Write summary JSON and Markdown report artifacts to the key-value store.

Type:boolean

Default:true

Max Targets

maxTargets

Optional

Maximum URL or header snapshots to audit.

Type:integer

Minimum:1

Maximum:250

Default:25

Fetch Timeout Milliseconds

fetchTimeoutMs

Optional

HTTP timeout for optional URL fetches.

Type:integer

Minimum:1000

Maximum:30000

Default:10000

Maximum Charge (USD)

maxChargeUsd

Optional

Hard local spending cap for actor-start, per-item, and report events. The actor stops before work or withholds uncharged output when the next event would exceed this amount.

Type:number

Minimum:0

Maximum:1000

Default:10

Dry Run

dryRun

Optional

Validate input and write a dry-run summary without PPE charges or dataset output.

Type:boolean

Default:false

Debug Logs

debug

Optional

Enable debug logs.

Type:boolean

Default:false

HTTP Security Headers Audit

mbeato/apimesh-security-headers

Audit 10 HTTP security headers with A+ to F grading. Checks CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and more.

Maximus Beato

HTTP Security Headers Checker

q_services/http-security-headers-checker

Audit HSTS, CSP, X-Frame-Options, Referrer-Policy and other HTTP security headers in bulk.

Q Services

Security Headers Checker

s3nafps/security-headers-checker

Check public URLs for common HTTP security headers including HSTS, Content Security Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Export a simple website security header report as JSON or CSV.

mohamed senator

Website Security Headers Checker

gochujang/security-headers-checker

Audit HTTP security headers for any URL: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. Returns a 0-100 score + letter grade + actionable findings. $0.005 per URL.

Hojun Lee

Bulk HTTP Security Headers Analyzer - CSP, HSTS

logiover/bulk-http-security-headers

Analyze HTTP security headers for thousands of URLs. Checks CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and more. Returns pass/fail per header plus a numeric security score. No API key, export to CSV/JSON. Ideal for security audits and compliance scanning.

Logiover

Security Headers Validator

stellar_ballet_0bu/security-headers-validator

Validate security response headers on any public URL: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. Per-Header pass/warn/fail with documented fix-hints.

Nikita S

Security Headers Checker - Audit CSP, HSTS, XFO and more

scrappy_garden/security-headers-checker

Check common HTTP security headers for one or more URLs (Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP). Useful for quick security hardening audits.

Bikram Adhikari

Security Headers Checker — OWASP Audit & Grading

accurate_pouch/security-headers

Audit 12 HTTP security headers (HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP, CORP, COEP). A-F grading, actionable recommendations. 5 URLs free.

Manchitt Sanan

Security Headers Checker API - HTTP Security Scanner

pink_comic/security-headers-checker

Security Headers Checker API for bulk HTTP security scans. Audit HSTS, CSP, X-Frame-Options, referrer and permissions policies, missing headers, website hardening gaps, and compliance posture. Returns grades, findings, and header evidence for security audits.

Ava Torres

HTTP & Security Headers Auditor

bgfc97/http-security-headers-audit

Audit any list of URLs: status, final redirect, HTTPS, server, security headers (HSTS, CSP, X-Frame-Options...), a security score, page title and CMS/generator. No key, no proxy.