Bulk HTTP Security Headers Checker & Grade (with change alerts)

Check many sites' HTTP security headers and get an A+ to F grade, with no login, no browser and no code. Export to JSON, CSV or Excel, or use the API.

Check many sites' HTTP security headers and get an A+ to F grade: HSTS (max-age, preload), Content-Security-Policy (unsafe-inline/eval flags), X-Frame-Options / frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/CORP, cookie Secure/HttpOnly/SameSite flags, HTTP->HTTPS redirect and server version leaks. Monitor mode flags header regressions.

Use cases

• Client security/compliance reports (agencies, MSPs)
• Catch header regressions after deploys or CDN changes
• Vendor/prospect security posture screening

Input

Field	Type	Notes
urls	array
maxConcurrency	integer
monitorMode	boolean	Remember grades/headers; later runs flag changes.
onlyChanged	boolean	In monitor mode, output only changed sites.
stateStoreName	string

Example input

{
 "urls": [
  "https://apify.com",
  "therealtour360.com",
  "https://github.com",
  "no-such-domain-zq81x.com"
 ],
 "monitorMode": true
}

Output

One dataset item per result. Main columns: url, finalUrl, statusCode, grade, score, missingHeaders, warnings, httpsRedirect, hsts, csp, server, isChanged, error. A RUN_SUMMARY record is saved to the default key-value store. See the sample output in the Output tab.

Example output

{
  "url": "https://github.com/",
  "finalUrl": "https://github.com/",
  "statusCode": 200,
  "redirects": 0,
  "score": 83,
  "grade": "A",
  "missingHeaders": [
    "Permissions-Policy"
  ],
  "warnings": [
    "Cookies missing Secure/HttpOnly/SameSite: _octo"
  ],
  "httpsRedirect": true,
  "hsts": "max-age=31536000; includeSubdomains; preload",
  "csp": "default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github...",
  "server": "github.com",
  "headers": {
    "strict-transport-security": "max-age=31536000; includeSubdomains; preload",
    "content-security-policy": "default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github...",
    "x-frame-options": "deny",
    "x-content-type-options": "nosniff",
    "referrer-policy": "origin-when-cross-origin, strict-origin-when-cross-origin",
    "server": "github.com"
  },
  "cookiesChecked": 3,
  "checkedAt": "2026-10-12T02:03:57.842Z",
  "changes": null,
  "isChanged": false
}

Pricing

Pay per result, with no monthly rental or subscription:

• Site checked: $0.001
• Headers changed (monitor): $0.005

Example: 1,000 results cost about $1.00 in fees. Apify's free plan includes $5 of monthly credit, which is enough to test this Actor.

FAQ

Do I need an account, cookies or a login for the source site? No. Bulk HTTP Security Headers Checker & Grade uses public data sources only, so there is nothing to connect and no account to risk.

How much will a run cost? You pay only for results delivered (see Pricing above), plus Apify platform usage, which the free plan's monthly credit easily covers for test runs. Start with a small limit to see the exact cost per run.

Can I export to CSV, Excel or Google Sheets? Yes. Every run's dataset can be downloaded as JSON, CSV, Excel, XML or HTML, or pushed to Google Sheets, Make, Zapier, n8n, Slack or a webhook through Apify integrations.

Can I run it on a schedule or from my own code? Yes. Add an Apify Schedule (hourly, daily, weekly) or call it through the Apify API / Python & JavaScript clients. It also works with AI agents through the Apify MCP server.

What happens if an input is invalid or a source is down? The run keeps going. The bad input gets a row with an error field so you can see what failed, and you are not charged for results that were not delivered.

Is this legal to use? It collects publicly available data. You are responsible for using the output in line with the source's terms and privacy laws such as GDPR/CCPA; don't use it for spam.

Something missing or broken? Open an issue on the Issues tab. Feature requests are usually added within a few days.

Scheduling / monitoring

Create a Schedule (daily/weekly) and connect a webhook or Slack/email integration.

Fair use

Official public APIs only, no login. Do not use output for spam or harassment. Respect the data sources' rate limits and terms.

Related tools

• Bulk SSL Certificate Expiry Checker & Monitor
• Subdomain Finder (Certificate Transparency) + Live Check
• Bulk Website Tech Stack Detector & Change Monitor
• Bulk SPF, DKIM & DMARC Domain Audit
• Cookie Consent & Tracker Compliance Checker (GDPR/CCPA)

Pipeline recipe: subdomain-finder → security-headers → website-screenshot: map a company's subdomains, grade each one's headers, then screenshot the live ones.

REST API

GET https://api.mediaprotools.com/v1/security-headers?items=... (header X-API-Key). Up to 5 items per call, separated by ,. Or POST {"items":[...],"options":{...}}.

Parameter	Type	Notes
items	token	URLs or domains

Output fields: checkedAt, cookiesChecked, csp, finalUrl, grade, headers, hsts, httpsRedirect, missingHeaders, redirects, score, server, statusCode, url, warnings.