Website Security Headers & HTTPS Audit

Crawl your website and check every page for the security configuration mistakes that leave visitors exposed: missing or weak security headers, insecure cookies, mixed content, and HTTP pages that don't redirect to HTTPS. You get a score per page and a summary across the whole site.

Passive and safe. This Actor only reads the responses your server already sends. It never scans ports, guesses paths, submits forms, or sends any kind of attack payload — so it's safe to run against production and against sites you don't own permission to pen-test.

Why this one

• More than a header check. It also flags cookies missing Secure / HttpOnly / SameSite, mixed content on HTTPS pages, and http:// URLs that don't redirect to HTTPS.
• A score per page and a whole-site summary, so you see which pages and which headers to fix first.
• Safe to run on any site. It only reads the responses a normal visit gets: no port scans, no path guessing, no attack payloads.
• Fair billing. The extra http:// request it makes to test the HTTPS redirect is never charged, and neither are unreachable URLs.
• Crawl a whole site or check a list of URLs, with an HSTS max-age threshold you can set.

What it checks

• HTTPS — is the page served over HTTPS, and does http:// redirect to it?
• Strict-Transport-Security (HSTS) — present, and is max-age long enough?
• Content-Security-Policy (CSP)
• X-Content-Type-Options: nosniff
• Referrer-Policy
• Permissions-Policy (and legacy Feature-Policy)
• Clickjacking protection — X-Frame-Options or CSP frame-ancestors
• Cookie flags — Secure, HttpOnly, SameSite
• Mixed content — http:// scripts, styles, images or iframes on an HTTPS page

Input

{ "startUrls": [{ "url": "https://example.com" }], "crawl": false }

Give it a list of URLs, or turn on crawl to sweep the whole site.

Output

One dataset row per URL:

{
  "finalUrl": "https://example.com/",
  "score": 78,
  "deductions": [{ "reason": "missing_csp", "points": 15 }],
  "headers": { "hsts": { "present": true, "value": "max-age=63072000" }, "csp": { "present": false } },
  "cookies": { "total": 2, "insecure": 1 },
  "mixedContent": { "count": 0 },
  "warnings": ["missing_csp"]
}

Plus a run SUMMARY: average score, how many pages miss each header, pages with insecure cookies or mixed content, and the lowest-scoring pages.

Use it for

• A quick security hygiene check before or after a launch
• Monitoring header configuration across a large site or many sites
• Producing an evidence trail for a security or compliance review
• CI gates — fail the build if a page's score drops

Pricing

Pay per URL audited. Unreachable URLs and the HTTPS-redirect probe are free.

Event	Price
URL audited	$0.002
Run start	$0.00005

Examples: 100 URLs cost about $0.20. A 1,000-page crawl costs about $2.00.

Run it from the API, a schedule or an automation

Run it on demand, schedule it in Apify Console → Schedules (e.g. weekly), or call it from code, n8n, Make or Zapier. One synchronous call returns the rows:

curl -X POST "https://api.apify.com/v2/acts/moonweil~website-security-audit/run-sync-get-dataset-items?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"startUrls":[{"url":"https://example.com"}],"crawl":true,"maxPages":100}'

Add a webhook or Slack / email integration on Run succeeded to get the results pushed to you.

FAQ

Is it safe to run against a site I don't own? It sends the same requests a visitor's browser would and only reads the response headers, cookies and HTML. It never probes, fuzzes or attacks anything. Still, only audit sites you have a reason to check.

Does it check SSL/TLS certificates or cipher suites? No. It checks that pages are served over HTTPS and redirect from HTTP, but it doesn't grade certificates or TLS versions.

How is the score calculated? Every page starts at 100. Each missing or weak protection deducts points, and the deductions are listed in the row, so you can see exactly why a page lost them.

Can I use it in CI? Yes. Call it from the API after a deploy and fail the build when a page's score drops below your threshold.