Pricing

from $3.00 / 1,000 url auditeds

Try for free

Go to Apify Store

Website Security Headers & HTTPS Audit

Try for free

Crawl your website for missing or weak security headers (HSTS, CSP, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, frame protection), insecure cookies, mixed content, and HTTP-to-HTTPS gaps. Passive and safe: only reads responses, never probes. Per-page score plus site summary.

Pricing

from $3.00 / 1,000 url auditeds

Rating

0.0

(0)

Developer

Aleksandr Jelohhin

Actor stats

Bookmarked

Total users

Monthly active users

2 days ago

Last modified

What it checks

HTTPS — is the page served over HTTPS, and does http:// redirect to it?
Strict-Transport-Security (HSTS) — present, and is max-age long enough?
Content-Security-Policy (CSP)
X-Content-Type-Options: nosniff
Referrer-Policy
Permissions-Policy (and legacy Feature-Policy)
Clickjacking protection — X-Frame-Options or CSP frame-ancestors
Cookie flags — Secure, HttpOnly, SameSite
Mixed content — http:// scripts, styles, images or iframes on an HTTPS page

Input

{ "startUrls": [{ "url": "https://example.com" }], "crawl": false }

Give it a list of URLs, or turn on crawl to sweep the whole site.

Output

One dataset row per URL:

{
  "finalUrl": "https://example.com/",
  "score": 78,
  "deductions": [{ "reason": "missing_csp", "points": 15 }],
  "headers": { "hsts": { "present": true, "value": "max-age=63072000" }, "csp": { "present": false } },
  "cookies": { "total": 2, "insecure": 1 },
  "mixedContent": { "count": 0 },
  "warnings": ["missing_csp"]
}

Plus a run SUMMARY: average score, how many pages miss each header, pages with insecure cookies or mixed content, and the lowest-scoring pages.

Use it for

A quick security hygiene check before or after a launch
Monitoring header configuration across a large site or many sites
Producing an evidence trail for a security or compliance review
CI gates — fail the build if a page's score drops

Pricing

Pay per URL audited. Unreachable URLs are not charged, and the extra http:// request used to check the HTTPS redirect is not charged — you only pay for the URLs you asked for (plus any pages found when crawl is on).

Phishing URL Detector

gochujang/phishing-url-detector

Check URLs against multiple free threat intelligence sources: Google Safe Browsing, domain age, redirect chains, suspicious patterns, and heuristic scoring. Returns a risk score (0-100) + verdict. No API key required for basic checks. $0.005 per URL.

Hojun Lee

Security Headers Checker

s3nafps/security-headers-checker

Check public URLs for common HTTP security headers including HSTS, Content Security Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. Export a simple website security header report as JSON or CSV.

mohamed senator

Bulk Email Deliverability Auditor - SPF, DKIM, DMARC

technicaldost/bulk-email-deliverability-auditor

Audit SPF, DKIM, DMARC and MX for thousands of domains at once. Returns a graded deliverability score, the parsed records, and a plain-English list of what is wrong. DNS only, so it is fast and costs a fraction of a cent per domain. No API key needed.

Technical Dost Solutions

Website Security Headers Checker

gochujang/security-headers-checker

Audit HTTP security headers for any URL: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy. Returns a 0-100 score + letter grade + actionable findings. $0.005 per URL.

Hojun Lee

Website Security Headers Scanner (Grade, HSTS, CSP, Cookies)

scrapers_lat/website-security-headers-scanner

Scan any website and grade its HTTP security headers, cookie flags, HTTPS enforcement and TLS certificate. Letter grade A+ to F, per-header pass/fail, HSTS/CSP parsing, redirect chain, optional cert expiry and AI remediation. For audits, PCI/SOC2 prep, recon and vendor due-diligence.

Scrapers Lat

Website Tech Stack Intelligence

skootle/website-tech-stack-intelligence

Explainable website technology fingerprints, confidence evidence, security headers, agent-ready lead qualification, API output, scheduling, and monitoring.

Skootle

Tech Stack Detector — Bulk Website Technology Lookup

accurate_pouch/tech-stack-detector

Detect frameworks, CMS, analytics, CDN, hosting, chat tools, and more for any list of URLs. No API key needed — reads public HTTP headers and HTML.

Manchitt Sanan

HTTP Headers Security Audit

seeb/http-headers-security-audit

Audit public websites for important HTTP security headers and export practical risk scores, missing headers, and improvement notes for security, SEO, and QA workflows.

Techionik

Cookie & Tracker Scanner - Cookies + Analytics/Ad Tags (No Key)

ninhothedev/cookie-tracker-scanner

$0.5/1K 🔥 Cookie & tracker scanner! Cookies + analytics/ad trackers (GA, Meta Pixel, Hotjar) on any URL. No key. JSON, CSV, Excel or API in seconds. Run privacy & GDPR audits ⚡

ninhothedev

Website Security Audit - Headers, SSL & Exposure Scanner

smart-digital/website-security-vulnerability-audit

Scan any website and get a 0-100 security score with the findings behind it: missing HTTP security headers, SSL/TLS issues, exposed files and server banners, CMS admin exposure, each with a severity and a concrete fix.

My Smart Digital

5.0

(1)

Public Security Headers & Cookie Surface Audit Agent

jacksu/public-security-headers-audit-agent

Audit public HTTP response security headers, HTTPS redirect behavior, and cookie attribute exposure without scanning, attacking, or storing cookie values.