Bulk HTTP Security Headers Analyzer 🛡️ — CSP, HSTS, Score & Grade (No API key)

---

Audit HTTP security headers for thousands of URLs in one run. This bulk security header scanner checks every URL for Content-Security-Policy (CSP), Strict-Transport-Security (HSTS), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, Cross-Origin-Embedder-Policy and more. Each check is weighted and scored, totaled into a 0–100 security score, and mapped to a letter grade from A+ to F. Paste a list of URLs and the Actor fetches their headers in parallel via HTTP HEAD — fast, lightweight, no page body downloaded. No API key, no login.

🏆 Why this security header scanner?

30+ fields per URL · thousands of URLs per run · 11 weighted checks + A+–F grade · HEAD-only (no page body) · export to JSON / CSV / Excel. The unofficial HTTP security header checker API for security audits, compliance scanning and bug-bounty recon.

Looking for a security header checker, a CSP auditor, an HSTS scanner, a bulk HTTP security audit tool, or a free HTTP security analyzer API? This Actor does all the checks at scale.

---

✨ What this Actor does / Key features

• 🛡️ 11 security header checks — CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, CORP, COEP, plus Server and X-Powered-By information-leak checks.
• 🎯 Numeric score (0–100) — each check is weighted by security importance; get a total score and a letter grade (A+ to F).
• 📋 Pass / fail per header — every header gets its own boolean pass/fail column plus the raw header value.
• 🧩 HSTS deep parse — max-age, includeSubDomains and preload flags extracted into separate fields.
• 🚨 Missing headers list — a comma-separated list of exactly which recommended security headers are absent.
• 🔍 Information-leak checks — flags when Server and X-Powered-By headers expose stack details.
• ↪️ Redirect-aware — follows up to 5 redirects and reports the finalUrl (so http:// → https:// is handled transparently).
• ⚡ HEAD-only, no body — HTTP HEAD is fast; all security headers live in the response headers.
• 🔑 No API key — works out of the box with standard HTTP requests; proxy support built in.

🚀 Quick start (3 steps)

1. Configure — paste your list of URLs into URLs to Analyze, one per line (https:// is added automatically if missing). Adjust Max Concurrency for large lists.
2. Run — click Start. The Actor fetches headers from every URL in parallel and scores each one.
3. Get your data — open the Output tab and export to JSON, CSV, Excel or XML, or pull it via the Apify API.

📥 Input

Give the Actor a urls list. Everything else is optional.

Example — audit a portfolio of sites

{
  "urls": ["https://github.com", "https://stackoverflow.com", "https://example.com"],
  "maxConcurrency": 20,
  "proxyConfiguration": { "useApifyProxy": true }
}

Example — large list, higher concurrency

{
  "urls": ["https://site1.com", "https://site2.com", "https://site3.com", "https://site4.com"],
  "maxConcurrency": 50,
  "proxyConfiguration": { "useApifyProxy": true }
}

Field	Type	Description
urls	array	Required. URLs to scan for security headers, one per line. HTTP and HTTPS both supported; the scheme is added automatically if missing.
maxConcurrency	integer	How many URLs to scan in parallel. Higher is faster. Default 20, max 100.
proxyConfiguration	object	Proxy used for the HTTP requests (recommended to avoid rate limiting). Default: Apify Proxy (datacenter).

Tip: HTTPS-only URLs produce the most meaningful results — plain HTTP sites won't return HSTS. Feed the output of a crawler or sitemap extractor into urls to audit an entire domain at once.

📤 Output

One row per URL — a full security-header report with 30+ fields, exportable to JSON, CSV, Excel or XML. Here is a trimmed sample record:

{
  "url": "https://github.com",
  "finalUrl": "https://github.com/",
  "statusCode": "200",
  "securityScore": "78",
  "grade": "B",
  "cspHeader": "default-src 'none'; ...",
  "cspPass": "true",
  "hstsHeader": "max-age=31536000; includeSubdomains; preload",
  "hstsPass": "true",
  "hstsMaxAge": "31536000",
  "hstsIncludeSubdomains": "true",
  "hstsPreload": "true",
  "xFrameOptions": "deny",
  "xFrameOptionsPass": "true",
  "xContentTypeOptions": "nosniff",
  "xContentTypeOptionsPass": "true",
  "referrerPolicy": "origin-when-cross-origin, strict-origin-when-cross-origin",
  "referrerPolicyPass": "true",
  "permissionsPolicy": "not set",
  "permissionsPolicyPass": "false",
  "crossOriginOpenerPolicy": "not set",
  "crossOriginOpenerPolicyPass": "false",
  "server": "GitHub.com",
  "xPoweredBy": "not set",
  "missingHeaders": "Permissions-Policy, Cross-Origin-Opener-Policy",
  "passCount": "8",
  "totalChecks": "11",
  "checkedAt": "2026-07-06T12:00:00.000Z"
}

💡 Use cases

• Security posture audits — scan your entire web portfolio and get a numeric score per URL; track improvement over time.
• Compliance scanning — check for missing HSTS, CSP and other headers referenced by SOC 2, ISO 27001 and PCI DSS controls.
• Vendor risk assessment — score third-party SaaS tools and partners on their HTTP security hygiene.
• Bug-bounty recon — identify sites with weak or missing security headers that broaden attack surface.
• DevSecOps CI/CD — run as a gate check after deployments to catch regressions in security header configuration.
• Competitor benchmarking — compare your security header posture against competitors on the same 0–100 scale.

👥 Who uses it

Security engineers & pentesters · bug-bounty hunters · DevSecOps & platform teams · compliance & GRC analysts · SaaS vendor-risk teams · agencies auditing client sites.

💰 Pricing

This Actor runs on a simple pay-per-result model — you pay for the URL reports you extract, with no separate Apify platform fees to calculate. Try it on the free tier first, then scale up. See the Pricing tab on this page for the current rate.

🔍 How it works

For each URL, the Actor sends an HTTP HEAD request (with automatic redirect following) and extracts every security-relevant header from the response. Each header is checked against a best-practice definition:

• CSP — must be present and well-formed (length > 10 chars). Weight: 20.
• HSTS — must have max-age ≥ 31,536,000 (1 year). Weight: 15.
• X-Frame-Options — must be DENY or SAMEORIGIN. Weight: 12.
• X-Content-Type-Options — must equal nosniff. Weight: 10.
• Referrer-Policy — must restrict referrer data. Weight: 10.
• Permissions-Policy — must be present. Weight: 8.
• COOP / CORP / COEP — cross-origin isolation headers. Weight: 5 each.
• Server / X-Powered-By — information leak: points awarded if NOT present. Weight: 5 each.

Scores are weighted and normalized to 0–100, then mapped to a letter grade (A+ ≥90, A ≥80, B ≥70, C ≥50, D ≥30, F <30). The missingHeaders field lists every recommended header that's absent, so you know exactly what to fix.

🧰 Tips & best practices

• HTTPS-only URLs produce more meaningful results — plain HTTP sites won't return HSTS.
• Filter by grade: "F" to prioritize the worst offenders first, or sort by securityScore descending for a leaderboard.
• Schedule recurring weekly runs and diff datasets to track security header improvements over time.
• Parse the missingHeaders field to generate prioritized remediation tickets per URL.
• Use maxConcurrency: 20+ for large lists and keep Apify Proxy enabled.

❓ Frequently Asked Questions

How do I check security headers for many URLs at once?

Paste your full URL list into the URLs to Analyze field and run the Actor once. It fetches headers from every URL in parallel via HTTP HEAD and returns one row per URL with pass/fail for each of the 11 checks, a score and a grade.

Which security headers are checked?

CSP, HSTS (with max-age ≥ 1 yr), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy and Cross-Origin-Embedder-Policy, plus Server and X-Powered-By information-leak checks.

Is there a free HTTP security header checker API?

Yes — this Actor works as an on-demand HTTP security header checker API with no API key of its own. Trigger it and pull results via the Apify API, so you can wire security-header scoring into your own tooling or CI pipeline.

Can I scan security headers without an API key or login?

Yes. The Actor needs no account, cookies or API key on the target sites — it sends standard HTTP HEAD requests. You only need an Apify account to run it.

How is the security score calculated?

Each header check carries a weight based on its security impact (CSP=20, HSTS=15, X-Frame-Options=12, and so on). The score is the weighted percentage of checks that pass, normalized to 0–100. Grade: A+ ≥90, A ≥80, B ≥70, C ≥50, D ≥30, F <30.

Can I export security header audits to CSV or JSON?

Yes — every URL is one row with dedicated columns for each header and its pass/fail status, so the dataset drops straight into a spreadsheet or BI tool. Export as CSV, JSON, Excel or XML from the run page or the Apify API.

Does it follow redirects?

Yes — the Actor follows up to 5 redirects automatically and reports the final URL in the finalUrl field, so http://example.com → https://example.com redirects are handled transparently.

What is a good HTTP security header score?

The Actor grades each URL from A+ to F on a 0–100 scale; anything below a C usually means missing CSP, HSTS or X-Frame-Options headers you should add.

How much data can I get?

You can scan thousands of URLs in a single run. Raise maxConcurrency (up to 100) for large lists, and feed URLs from a sitemap or crawler to audit an entire domain at once.

Is it legal to scan security headers?

Reading a site's HTTP response headers is a standard, lightweight request that downloads no page content. This Actor only inspects publicly returned headers; you are responsible for scanning within applicable terms and laws, and for using the results responsibly.

🔗 More web-infra & security tools by logiover

Pair the security header analyzer with the rest of the bulk web-infrastructure and recon suite:

Actor	What it does
Bulk SSL Certificate Checker	SSL/TLS cert expiry, issuer, SANs, TLS versions & chain validation
Bulk DNS Records Lookup	A, AAAA, MX, TXT, NS, CNAME, SOA, CAA for thousands of domains
Bulk WHOIS / RDAP Lookup	Domain registration, registrar, dates & nameservers in bulk
Bulk URL Status Checker	HTTP status codes, broken links & redirects for large URL lists
Bulk URL Unshortener	Expand shortened links and trace full redirect chains
Bulk Website Screenshot Capture	Full-page screenshots for many URLs at once
Subdomain Finder	Enumerate subdomains for a domain — attack-surface recon
Certificate Transparency Monitor	Monitor CT logs for newly issued certificates
Website Tech Stack Detector	Detect frameworks, CMS, analytics & server tech
Website SEO Audit Crawler	On-page SEO analysis across a whole site
Sitemap to URL Crawler	Expand sitemaps into a clean, dedup'd URL list to feed this scanner

👉 Browse all logiover scrapers on Apify Store — 180+ actors across real estate, jobs, crypto, social media & B2B data.

⏰ Scheduling & integration

Schedule this Actor on Apify to re-scan your web portfolio daily or weekly and track security-header posture over time. Export results to JSON, CSV or Excel, sync to Google Sheets, or push to your database, SIEM, BI tools and webhooks through the Apify API. Connect it to Make, n8n or Zapier to alert on new grade: "F" URLs or feed remediation tickets into Jira.

⭐ Support & feedback

Found a bug or need an extra header check? Open an issue on the Issues tab — response is usually fast. If this Actor saves you time, a ★★★★★ review on the Store page genuinely helps and is hugely appreciated. 🙏

⚖️ Legal

This Actor inspects only publicly returned HTTP response headers and downloads no page content. It is intended for legitimate security auditing, compliance and research use. You are responsible for scanning within the target sites' terms of service and any applicable local laws, and for handling results responsibly.

---

📝 Changelog

2026-07-06

• ✨ README overhaul: badge/hero/callout structure, richer output sample, ready-to-run example scenarios, web-infra & security cross-promo links, expanded FAQ and clearer quick-start.

2026-07-01

• Maintenance pass: re-verified end-to-end on live data and confirmed successful runs within the 5-minute quality window on the default input.
• Sharpened Store metadata (SEO title & description) and expanded the FAQ with high-intent, long-tail questions for easier discovery in Google and Apify Store search.
• Added ready-to-run example tasks that cover common real-world use cases.

2026-06-24

• Initial release — 11 security header checks with weighted scoring, A+ to F grading, no API key, CSV/JSON export.