Domain & HTTPS Security Audit — SSL Expiry & Headers

Audit a list of domains for transport security: TLS certificate validity and days to expiry, issuer and SAN count, negotiated protocol version, and the six standard security headers (HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy). Returns a 0-100 score, a letter grade and a named finding with a concrete fix for every gap. Built by PAOE.

Each item is processed individually and charged as its own event, so you pay only for what the run actually delivers. Results are written to the run's dataset as one JSON object per item, ready to download as JSON, CSV or Excel, or to pull through the Apify API.

What it checks

For each domain: whether the TLS certificate verifies, its issuer, subject and SAN count, how many days remain before it expires, and the negotiated protocol version (with anything below TLS 1.2 treated as a failure). Then the six standard transport-security response headers: HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy.

Pricing

Event	What it covers	Price
domain-audited	domain audited (primary)	$0.02 per event

Volume tiers reduce the price automatically on higher Apify plans: Bronze 15% off, Silver 25% off and Gold or above 40% off the listed free-tier price. The charge is per item processed, not per run.

Input

Field	Type	Required	Default	Description
domains	array	yes	["example.com"]	Domains or full URLs. Each domain audited is one charged event.
maxDomains	integer	no	100	Hard cap on how many domains are audited in one run.

Example input:

{
  "domains": [
    "example.com"
  ],
  "maxDomains": 100
}

Output

One JSON object per item in the run's dataset. Every result carries the input it came from plus the fields this Actor measures, so the output can be joined back to your own data without guessing which row is which. The final dataset entry is a summary object with the run's totals.

Typical use cases

• Catch certificates approaching expiry before they lapse.
• Audit security headers across a portfolio of domains.
• Produce a per-domain remediation list for a platform team.

Limitations

No. This is a configuration audit of publicly visible signals: the certificate the server presents and the headers it returns. It does not probe for vulnerabilities, does not send exploit payloads and makes no claim that a domain is secure. A high score means the visible transport configuration is sound, nothing more. Domains that do not serve HTTPS are reported as unreachable rather than scored as failing many things.

Is this a penetration test?

Every limitation above is reported per item in a findings entry with a level of fail, warn, info or ok, a machine-readable code and a concrete action. If something cannot be checked it is reported as such rather than assumed to be fine.

Can it run on a schedule?

Yes. Save a task from this Actor with your inputs, then set a schedule on the task. Scheduled runs recur with the same inputs, which is the intended way to use it for ongoing monitoring.

Can I use this to watch expiry on a schedule?

That is the main use. Save a task on a schedule, and each run reports days_to_expiry per domain plus a summary count of domains expiring within 45 days, so you can alert on it.

Notes

If a site returns something unexpected, open an issue on the Actor's page with the URL and the input used, and it will be looked at.

Related Actors

• Bulk Email Deliverability Check

Keywords

ssl check, tls audit, certificate expiry, security headers, HSTS, CSP, domain security audit, SSL expiry monitor.