HTTP Security Headers Checker – Bulk HSTS, CSP & X-Frame-Options Scan with A–F Grade

HTTP Security Headers Checker scans any list of websites and reports which HTTP security headers they send: Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. Every URL gets an A–F security grade, a 0–6 score and a list of missing headers, plus the raw header values, HTTPS status, Server / X-Powered-By leaks and a Secure-cookie check. Paste URLs, click Start and export a security headers report to JSON, CSV, Excel or Google Sheets. No API key, no browser extension, pay only per URL checked.

Made for security and compliance teams running bulk audits, web agencies checking client sites, pentesters doing quick recon, and MSPs or SaaS vendors that need a cheap, scriptable alternative to checking securityheaders.com one site at a time.

What data can you extract?

Field	Example	Description
url	https://www.github.com	URL as you entered it
final_url	https://github.com/	URL after following redirects
status_code	200	HTTP status of the final response (null if unreachable)
is_https	true	Whether the final URL uses HTTPS
grade	B	Security grade: A = 6/6 core headers, B = 5, C = 4, D = 3, E = 2, F = 0–1
score	5	Number of the six core security headers present (0–6)
missing_headers	["Permissions-Policy"]	Core security headers that are missing
hsts	max-age=31536000; includeSubdomains; preload	Strict-Transport-Security value
csp	default-src 'none'; base-uri 'self'; …	Content-Security-Policy value
x_frame_options	deny	X-Frame-Options value (clickjacking protection)
x_content_type_options	nosniff	X-Content-Type-Options value
referrer_policy	strict-origin-when-cross-origin	Referrer-Policy value
permissions_policy	null	Permissions-Policy value
x_xss_protection	0	Legacy X-XSS-Protection value (informational, not graded)
cross_origin_opener_policy	same-origin	Cross-Origin-Opener-Policy value (informational)
server / x_powered_by	github.com / null	Server and technology disclosure headers
cookies_secure	true	true if a Set-Cookie header carries the Secure flag, null if no cookie was set
scraped_at	2026-10-15T18:03:24+00:00	UTC timestamp of the check

How to use the Security Headers Checker

1. Open the actor and paste websites into URLs to check – full URLs (https://shop.example.com/login) or bare domains (example.com, HTTPS is assumed).
2. Optionally set Max URLs to check (default 100, up to 1,000 per run), then click Start.
3. Download the report as JSON, CSV or Excel, or push it to Google Sheets, Make, Zapier or n8n. Use Schedules to re-audit your sites weekly and catch regressions after deployments.

Example input:

{
  "startUrls": ["https://www.apify.com", "https://www.github.com", "example.com"],
  "maxItems": 100
}

Each URL is requested once with a Chrome-like browser fingerprint, redirects are followed, and the headers of the final response are analysed.

Output example

Real output from a local test run with the default input (one item, long CSP shortened):

{
  "url": "https://www.github.com",
  "final_url": "https://github.com/",
  "status_code": 200,
  "is_https": true,
  "grade": "B",
  "score": 5,
  "hsts": "max-age=31536000; includeSubdomains; preload",
  "csp": "default-src 'none'; base-uri 'self'; child-src github.githubassets.com ...; upgrade-insecure-requests",
  "x_frame_options": "deny",
  "x_content_type_options": "nosniff",
  "referrer_policy": "origin-when-cross-origin, strict-origin-when-cross-origin",
  "permissions_policy": null,
  "x_xss_protection": "0",
  "cross_origin_opener_policy": null,
  "server": "github.com",
  "x_powered_by": null,
  "cookies_secure": true,
  "missing_headers": ["Permissions-Policy"],
  "scraped_at": "2026-10-15T18:03:24.326913+00:00"
}

In the same run, https://www.apify.com received grade C (4/6) with missing_headers: ["Referrer-Policy", "Permissions-Policy"]. Unreachable sites still produce a row (status_code: null, grade F), so one dead URL never breaks the report.

Pricing

This actor uses pay-per-event pricing – you only pay for URLs actually checked:

• $1.00 per 1,000 checked URLs ($0.001 per result)
• $0.00005 per actor start (per GB of memory)

Examples:

Scenario	Cost
50 client websites, one audit	≈ $0.05
1,000 URLs, one run	≈ $1.00
200 sites re-audited weekly (4 runs/month)	≈ $0.80 / month
10,000 domains split over 10 runs	≈ $10.00

No proxies or third-party APIs are used, so there are no hidden costs. The Apify free plan's monthly credit covers thousands of checks.

Use cases

• Security & compliance audits – document HSTS, CSP and clickjacking protection for ISO 27001, SOC 2, PCI DSS or GDPR evidence across all company domains.
• Agency client reporting – grade every client website A–F and show exactly which headers to add.
• Vendor and supply-chain risk – quickly assess the web security hygiene of suppliers or acquisition targets.
• Pentest and bug bounty recon – find missing CSP, weak HSTS and Server / X-Powered-By technology leaks at scale.
• Deployment regression checks – run after each release and alert when a grade drops or a header disappears.
• Security-focused lead generation – find companies with poor grades as prospects for security services.

Integrations and API

Run the security headers scanner from the Apify API, CLI or any integration: Make, Zapier, n8n, Google Sheets, Slack, Airbyte or webhooks. Filter on grade or missing_headers to trigger alerts or tickets.

Python example with the official apify-client:

from apify_client import ApifyClient

client = ApifyClient("<YOUR_APIFY_TOKEN>")
run = client.actor("ninhothedev/security-headers-checker").call(
    run_input={"startUrls": ["https://www.apify.com", "https://www.github.com"], "maxItems": 100}
)
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item["url"], item["grade"], item["score"], item["missing_headers"])

FAQ

Is it legal to check security headers? Yes. The actor makes one ordinary GET request per URL – like opening the page in a browser – and reads only the public response headers. It does not probe for vulnerabilities.

How is the grade calculated? One point for each of the six core headers present: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. 6 = A, 5 = B, 4 = C, 3 = D, 2 = E, 0–1 = F. Header values are reported as-is; the grade checks presence, not the strength of each policy.

How many URLs can I check per run? Up to 1,000 (Max URLs to check). For bigger lists, split them across several runs or call the actor in a loop via the API.

Do I need proxies? No. Requests use a Chrome-like TLS fingerprint and work for most sites. If a site blocks the request, you will see it in status_code (e.g. 403); the headers of that response are still analysed.

Can I schedule recurring audits? Yes – create an Apify Schedule with your URL list and connect the dataset to Google Sheets, Slack or a webhook to track grades over time.

Something does not work? Open an issue on the actor's Issues tab with the run ID and an example URL – we usually respond within a day.

Related actors

• Website Uptime & Status Checker – bulk HTTP status, response time and SSL validity check.
• Redirect Chain Tracer – every redirect hop with status codes up to the final URL.
• Website Link Extractor – list all internal and external links of a website.
• JSON-LD Extractor – pull Schema.org structured data from any page.
• Website Contact & Email Extractor – find emails, phones and social profiles on websites.