Security Headers & SSL Certificate Checker API

Problem: you run an agency, a monitoring tool, a compliance check or a pentest pre-scan and need to know in seconds whether a company website sends the right security headers and whether its SSL certificate is healthy. The manual way is curl -I, openssl s_client and a checklist.

This API: up to 50 hosts per call. One row per host with a grade from A+ to F, every security header with a verdict and the exact line to add, and the TLS certificate with days left.

• Headers: Strict-Transport-Security (max-age, includeSubDomains, preload), Content-Security-Policy (present, unsafe-inline, unsafe-eval, wildcard sources, report-only only), X-Frame-Options or CSP frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener / Resource / Embedder-Policy.
• Cookies: how many Set-Cookie headers have Secure, HttpOnly and SameSite. Names and values are never returned.
• Information leaks: Server and X-Powered-By headers that disclose a version. Deprecated headers (X-XSS-Protection, Expect-CT) are listed as notes.
• Redirect: does plain http:// redirect to https://, and the final URL after redirects.
• Certificate: subject, SAN count and first 20 SANs, issuer, notBefore / notAfter, daysLeft, expired, expiringSoon, hostname match, self-signed / untrusted verdict with the verify error text, signature algorithm, key type and size, SHA-256 fingerprint.
• TLS: negotiated version and cipher, and which of TLS 1.0 / 1.1 / 1.2 / 1.3 the server accepts (accepted, rejected, or not_testable when the local OpenSSL cannot try that version).
• Issues: sorted by severity, each with an exact fix line.

Why it is different

• "Could not check" is never "header missing". A host that times out, has no DNS entry or refuses the connection returns a row with an error code (dns_error, timeout, blocked_private_address, tls_error: ...) and no grade.
• Bad certificates are still read. Expired, self-signed and wrong-host certificates are reported with the verify error text, and the headers are graded as well.
• Fix lines, not just findings. Every missing or weak header comes with the header line to add.
• Deterministic grade. The scoring table below is the full rule set. The same input gives the same grade.
• Monitor mode: onlyNew: true + monitorId returns only hosts whose grade dropped, whose header disappeared, whose certificate was replaced or that entered the certificate warning window.

Example (API)

curl -X POST "https://api.apify.com/v2/acts/martin10291~security-headers-ssl-check/run-sync-get-dataset-items?token=YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"hosts": ["github.com", "example.com"], "certWarnDays": 30}'

Output row (trimmed, measured on 2026-11-12):

{"host": "github.com", "url": "https://github.com/", "status": "ok", "finalUrl": "https://github.com/", "httpStatus": 200,
 "httpToHttps": {"checked": true, "redirectsToHttps": true, "status": 301},
 "grade": "B", "score": 87, "issueCount": 5,
 "headers": {
   "strictTransportSecurity": {"present": true, "value": "max-age=31536000; includeSubdomains; preload", "maxAge": 31536000, "includeSubDomains": true, "preload": true, "verdict": "good"},
   "contentSecurityPolicy": {"present": true, "reportOnly": false, "unsafeInline": false, "unsafeEval": false, "wildcardSource": false, "verdict": "good"},
   "xFrameOptions": {"present": true, "value": "deny", "verdict": "good"},
   "permissionsPolicy": {"present": false, "verdict": "missing", "fix": "Permissions-Policy: camera=(), microphone=(), geolocation=()"}
 },
 "cookies": {"count": 3, "secure": 3, "httpOnly": 2, "sameSite": 3, "sameSiteNoneWithoutSecure": 0},
 "certificate": {"subjectCN": "github.com", "issuerCN": "Sectigo Public Server Authentication CA DV E36", "sanCount": 2,
                 "notBefore": "2026-10-30T00:00:00Z", "notAfter": "2027-01-27T23:59:59Z", "daysLeft": 76, "expired": false,
                 "expiringSoon": false, "hostnameMatch": true, "trusted": true, "selfSigned": false,
                 "signatureAlgorithm": "ecdsa-with-SHA256", "keyType": "EC P-256", "keyBits": 256},
 "tls": {"negotiated": "TLSv1.3", "supported": {"TLSv1.0": "rejected", "TLSv1.1": "rejected", "TLSv1.2": "accepted", "TLSv1.3": "accepted"}},
 "issues": [{"severity": "low", "area": "permissions-policy", "issue": "Permissions-Policy header is missing.",
             "fix": "Permissions-Policy: camera=(), microphone=(), geolocation=()", "points": 4}],
 "checkedAt": "2026-11-12T14:45:07Z"}

Scoring (grade A+ to F)

The score starts at 100 and loses the points below, once per finding. Info items cost 0 points.

Finding	Points
Site served over plain HTTP at the final URL	30
Strict-Transport-Security missing (HTTPS sites)	15
HSTS max-age under 15552000 s (180 days)	5
Content-Security-Policy missing, or only the Report-Only header	20 / 15
CSP without script-src and default-src	6
CSP 'unsafe-inline' in script-src (ignored when a nonce, hash or 'strict-dynamic' is present)	8
CSP 'unsafe-eval' in script-src	5
CSP wildcard or scheme-only source (*, http:, https:) in script-src	6
No clickjacking protection (no X-Frame-Options DENY/SAMEORIGIN and no CSP frame-ancestors)	10
X-Frame-Options with another value and no frame-ancestors	5
X-Content-Type-Options not nosniff	8
Referrer-Policy missing	6
Referrer-Policy unsafe-url or no-referrer-when-downgrade	3
Permissions-Policy missing	4
Cross-Origin-Opener-Policy / Resource-Policy / Embedder-Policy missing	2 each
Cookies without Secure (HTTPS sites)	6
Cookies without HttpOnly	3
Cookies without SameSite	2
Cookies with SameSite=None but no Secure	3
Server header with a version, X-Powered-By, X-AspNet(Mvc)-Version	3 each
Plain http:// does not redirect to HTTPS (only when port 80 answers)	8
Certificate expired	50
Certificate not valid yet	40
Certificate expires inside the warning window (certWarnDays)	10
Certificate does not cover the hostname	40
Certificate chain not trusted or self-signed	40
RSA key under 2048 bits	15
Signature algorithm MD5 or SHA-1	15
Server accepts TLS 1.0 or 1.1	10
Server does not accept TLS 1.3	3
X-XSS-Protection (other than 0), Expect-CT, HSTS without includeSubDomains	0 (note)

Grade: A+ = 100, A = 90 to 99, B = 80 to 89, C = 65 to 79, D = 50 to 64, F = below 50. The grade is F whatever the score when the certificate is expired, does not cover the hostname, is not trusted, or the site is only served over plain HTTP. Severity of an issue: high from 15 points, medium from 6, low from 1, info for 0. Issues are sorted by severity, then points.

A check that could not run (timeout, TLS handshake failure) adds no points: if the headers cannot be fetched there is no grade, if the certificate cannot be read there are no certificate points.

Schedule it / monitor your sites

Run it daily or weekly with an Apify schedule and set onlyNew: true with a monitorId such as my-customers and certWarnDays such as 21. The first run returns every host (change: first_check). Later runs return only hosts where the grade dropped (grade_dropped:A->B), a security header disappeared (header_removed:strictTransportSecurity), the certificate was replaced (certificate_changed) or the certificate entered the warning window (certificate_expiry_warning); the reasons are in changes. Connect the dataset to a webhook, Slack, Zapier or Make through an Apify integration to get an alert. A run with no change returns no rows and no charge. Hosts that could not be reached in that run (timeout, refused connection) are skipped and tried again next run, they never overwrite the stored state.

Use from agents (MCP)

Add the Apify MCP server (https://mcp.apify.com?tools=martin10291/security-headers-ssl-check) to Claude, Cursor or any MCP client and ask: "Check the security headers and certificate of these sites and list the fixes: ...".

Input

Field	What it does
hosts	Domains, host:port or URLs, up to 50 (ports 80, 443, 8080, 8443)
host / url	Shortcuts for a single site
certWarnDays	Days before expiry that count as "expiring soon" (default 30)
onlyNew / monitorId	Return only hosts that changed since the last run with this Monitor ID

What it does on the network

Per host: one DNS lookup, one GET of the front page you give (plus redirects, at most 5), one plain-HTTP request to see the redirect, one TLS handshake for the certificate (two when the first fails verification, to still read the certificate) and one handshake per TLS version. No port scanning, no path guessing, no exploitation, no logins. The User-Agent is RadarSecurityCheck/1.0. Private, loopback, link-local and reserved addresses are refused and re-checked on every redirect.

Honest limits

• Front page only. Headers can differ per path (an API or an admin area may send other headers).
• Headers are read from the final response after redirects (up to 5). Sites that block automated clients can answer with a bot-protection page whose headers differ from the real site.
• The certificate is the one served for the hostname on port 443 (or on the port you give), with SNI. Only the leaf certificate is reported; the standard library does not return the chain, so chain order and intermediates are not checked beyond the trust verdict.
• Trust verdict uses the certificate store of the machine running the check. The verify error text is returned.
• TLS versions: each is one handshake attempt. not_testable means the local OpenSSL refuses that version; unknown means the attempt timed out.
• A grade is a header and certificate hygiene score, not a penetration test or a guarantee that a site is safe.
• Checked from one location. CDNs can answer differently by region.

FAQ

Pricing? $1.00 / 1000 results (one row per host, or per changed host in monitor mode). Do I need a key? No. Only the website you name is contacted. Does it return cookie values? Never. Only counts of the Secure, HttpOnly and SameSite flags. Why is there no grade for a host? The page could not be fetched (see headersError): that is reported as an error, never as missing headers. How fresh is the data? Live: every call performs the requests again.