HTTP Security Headers Analyzer

HTTP Security Headers Analyzer

HTTP Security Headers Analyzer audits any website's security headers against OWASP standards, industry best practices (Mozilla Observatory), and compliance frameworks (PCI-DSS, SOC 2, ISO 27001, NIST). Get a clear A–F grade, per-header severity analysis, and actionable fix recommendations — all in a single API call.

---

What does it do?

Audit any website's security headers against OWASP standards, industry best practices (Mozilla Observatory), and compliance frameworks (PCI-DSS, SOC 2, ISO 27001, NIST). Get a clear A–F grade, per-header severity analysis, and actionable fix recommendations — all in a single API call.

Features

• 16 Header Checks: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, CORS, Referrer-Policy, Permissions-Policy, X-XSS-Protection, Cross-Origin-Resource-Policy, Cross-Origin-Embedder-Policy, Cross-Origin-Opener-Policy, Clear-Site-Data, Cache-Control, Pragma, Expires, Server Info Disclosure
• OWASP Weighted Scoring (0–100): Critical/high/medium/low severity weights produce a normalized security score
• A–F Letter Grades: Clear, actionable grades from A (Excellent) to F (Critical)
• Deep Header Analysis: Value validation, misconfiguration detection, weak-configuration warnings, version disclosure checks
• Policy Compliance: Automatic mapping to PCI-DSS v4.0, SOC 2 CC6.1, ISO 27001 Annex A, and NIST SP 800-53 controls
• Multi-Mode Operations:
  • analyze — Quick full header scan with scores
  • scorecard — Comprehensive A–F security scorecard
  • batch — Bulk analysis for 5+ URLs with aggregated statistics
  • remediation — Prioritized, step-by-step fix instructions
• Concurrent Batch Scanning: 5 concurrent requests with automatic retry (3 attempts) and exponential backoff
• Human-Readable Reports: Plain-text report included in output dataset
• Remediation Guides: Copy-paste ready header configurations for Apache, Nginx, Express, and other platforms

Why Use This?

Pain Point	How This Actor Helps
Missing security headers	Detects 16 critical headers and flags every missing or misconfigured one
No OWASP compliance tracking	Maps every header to OWASP cheat sheets and industry references
Policy audit burden	Automatic PCI-DSS, SOC 2, ISO 27001, and NIST compliance mapping
Hard-to-interpret results	Clear A–F grades and per-header severity (critical/high/medium/low)
Manual CI/CD integration	JSON output, cURL & Python examples, MCP server support
No fix guidance	Copy-paste ready remediation for every finding
Slow bulk scanning	Concurrent batch scanning with retry logic and error isolation

Personas

Persona	How They Use It
Security Engineer	Quick security posture assessment for any web property
Compliance Officer	Verify security header requirements for PCI-DSS, SOC 2, ISO 27001
DevOps Engineer	Automate header checks in CI/CD pipelines
Penetration Tester	Document missing security controls in assessment reports
Web Developer	Validate header configuration before production deployment

Input Parameters

Field	Type	Default	Description
url	string	—	Website URL to analyze (scheme optional, https:// assumed)
action	select	analyze	Analysis mode: analyze, scorecard, batch, remediation
batchMode	boolean	false	Enable batch scanning of multiple URLs
batchData	array	[]	Structured URL list for batch mode (max 50)
includeRemediation	boolean	true	Include detailed fix recommendations

Example Input

Single URL analysis:

{
  "url": "https://example.com",
  "action": "scorecard",
  "batchMode": false,
  "includeRemediation": true
}

Batch analysis:

{
  "action": "analyze",
  "batchMode": true,
  "batchData": [
    { "url": "https://example.com" },
    { "url": "https://google.com" },
    { "url": "https://github.com" }
  ],
  "includeRemediation": false
}

Output Format

Field	Type	Description
url	string	Analyzed URL (final after redirects)
score	number	Normalized security score (0–100)
grade	string	Letter grade (A, B, C, D, F)
grade_label	string	Grade description (Excellent → Critical)
total_headers	integer	Number of headers checked (16)
present_count	integer	Headers present in the response
missing_count	integer	Headers absent from the response
secure_count	integer	Headers correctly configured
critical_issues	integer	Number of critical-severity findings
high_issues	integer	Number of high-severity findings
findings	array	Per-header analysis results with issues, severity, and remediation
policy_compliance	object	Compliance % for PCI-DSS, SOC 2, ISO 27001, NIST
analyzed_at	string	ISO 8601 timestamp of the analysis

Example Output

{
  "url": "https://example.com",
  "score": 72.0,
  "grade": "B",
  "grade_label": "Good",
  "total_headers": 16,
  "present_count": 10,
  "missing_count": 6,
  "secure_count": 5,
  "insecure_present_count": 5,
  "critical_issues": 1,
  "high_issues": 1,
  "findings": [
    {
      "header": "Strict-Transport-Security",
      "name": "HTTP Strict Transport Security",
      "present": true,
      "value": "max-age=31536000",
      "secure": false,
      "severity": "critical",
      "issues": [
        "Missing includeSubDomains directive",
        "Missing preload directive (optional but recommended)"
      ],
      "remediation": "Add the following HTTP response header:\n  Strict-Transport-Security: max-age=31536000; includeSubDomains",
      "score_penalty": 7,
      "expected": "max-age=31536000; includeSubDomains; preload",
      "policy_refs": {
        "PCI-DSS": "PCI-DSS v4.0 Req 6.5.10",
        "ISO 27001": "A.8.8",
        "NIST": "SC-8"
      }
    }
  ],
  "policy_compliance": {
    "PCI-DSS": {
      "applicable_checks": 6,
      "passed": 2,
      "failed": 4,
      "compliance_pct": 33.3
    }
  },
  "analyzed_at": "2026-07-20T12:00:00.000000+00:00"
}

API Usage

cURL

# Quick analysis
curl -X POST "https://api.apify.com/v2/acts/perryay~http-security-headers-analyzer/runs?token=YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com", "action": "analyze"}'

# Full scorecard
curl -X POST "https://api.apify.com/v2/acts/perryay~http-security-headers-analyzer/runs?token=YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com", "action": "scorecard"}'

# Batch mode
curl -X POST "https://api.apify.com/v2/acts/perryay~http-security-headers-analyzer/runs?token=YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "action": "analyze",
    "batchMode": true,
    "batchData": [
      {"url": "https://example.com"},
      {"url": "https://google.com"}
    ]
  }'

Python (Apify Client)

from apify_client import ApifyClient

client = ApifyClient("YOUR_API_TOKEN")

# Run the actor
run = client.actor("perryay/http-security-headers-analyzer").call(
    run_input={
        "url": "https://example.com",
        "action": "scorecard",
        "includeRemediation": True,
    }
)

# Fetch results from the dataset
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item["grade"], item["score"], item["url"])
    for finding in item.get("findings", []):
        if not finding["secure"]:
            print(f"  ✗ {finding['header']}: {', '.join(finding['issues'])}")

Python (httpx — Direct API)

import httpx
import asyncio

async def analyze_headers(url: str, api_token: str) -> dict:
    async with httpx.AsyncClient() as client:
        # Start the actor run
        run_resp = await client.post(
            "https://api.apify.com/v2/acts/perryay~http-security-headers-analyzer/runs",
            params={"token": api_token},
            json={"url": url, "action": "scorecard", "includeRemediation": True},
        )
        run = run_resp.json()
        run_id = run["data"]["id"]

        # Poll until finished
        while True:
            status_resp = await client.get(
                f"https://api.apify.com/v2/actor-runs/{run_id}",
                params={"token": api_token},
            )
            status = status_resp.json()["data"]["status"]
            if status == "SUCCEEDED":
                break
            elif status in ("FAILED", "TIMED-OUT", "ABORTED"):
                raise RuntimeError(f"Run {status}")
            await asyncio.sleep(2)

        # Fetch results
        dataset_id = status_resp.json()["data"]["defaultDatasetId"]
        items_resp = await client.get(
            f"https://api.apify.com/v2/datasets/{dataset_id}/items",
            params={"token": api_token, "format": "json"},
        )
        return items_resp.json()

result = asyncio.run(analyze_headers("https://example.com", "YOUR_API_TOKEN"))
print(f"Grade: {result[0]['grade']} — Score: {result[0]['score']}")

Use Cases

1. Pre-Deployment Security Check — Scan staging URLs before production release
2. CI/CD Pipeline Integration — Fail builds when score drops below threshold
3. Compliance Auditing — Map header coverage to PCI-DSS, SOC 2, ISO 27001
4. Vendor Risk Assessment — Evaluate third-party service security posture
5. Bug Bounty Support — Document known header gaps in penetration tests
6. SSL/TLS Migration — Verify HSTS configuration after certificate changes
7. MCP-Enabled Analysis — Query via Claude Desktop or any MCP client
8. Batch Security Sweep — Scan all subdomains in a single run
9. Remediation Tracking — Track fix progress over multiple scan runs
10. Security Policy Enforcement — Verify internal header policies against standards

FAQ

1. What headers does this actor check? 16 headers: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Access-Control-Allow-Origin, X-XSS-Protection, Cross-Origin-Resource-Policy, Cross-Origin-Embedder-Policy, Cross-Origin-Opener-Policy, Clear-Site-Data, Cache-Control, Pragma, Expires, and Server information disclosure.

2. What scoring methodology is used? OWASP-referenced weighted scoring. Each header has a severity weight (critical=25, high=15, medium=8, low=3). Missing headers incur full penalty; present but misconfigured headers incur partial penalty. The final score is normalized to 0–100 and mapped to A–F grades (A≥90, B≥75, C≥50, D≥25, F<25).

3. What does each grade mean?

• A (90–100): Excellent — strong security posture, minimal improvements needed
• B (75–89): Good — solid protection, some non-critical improvements recommended
• C (50–74): Fair — moderate protection, several important headers missing
• D (25–49): Poor — weak protection, many security headers absent
• F (0–24): Critical — serious protection gaps, urgent action required

4. Does the actor follow redirects? Yes. The actor follows all redirects and reports the final URL's headers. The original and final URLs are both tracked.

5. What happens if the URL is unreachable? The actor returns an error record with details (timeout, DNS failure, connection refused). The analysis continues for other URLs in batch mode. Retry logic with exponential backoff (3 attempts) handles transient failures.

6. How many URLs can I scan in one run? Up to 50 URLs per run in batch mode. For best performance, keep individual batches under 20 URLs.

7. Can I use this in CI/CD? Yes. The actor returns clean JSON that can be processed by any CI tool. Example: fail a GitHub Action when the score drops below 50.

8. What compliance frameworks are supported? PCI-DSS v4.0, SOC 2 (CC6.1), ISO 27001 Annex A, and NIST SP 800-53. Each header maps to relevant controls automatically.

9. Can I test locally before deploying? Yes. Clone the repository, install dependencies (pip install apify httpx), and run python main.py with local Apify test input.

10. How many URLs can I scan at once? Up to 50 URLs per run in batch mode. For best performance, keep individual batches under 20 URLs.

11. What happens if a header has a very long value? A: The actor truncates header values exceeding 4096 characters for analysis and display purposes. The full raw value can still be accessed through the dataset's raw output. Truncation is flagged in the finding object with a truncated: true field.

---

Usage & Billing

This actor uses Apify's PAY_PER_EVENT pricing model. You are charged only for successful runs based on the events your usage triggers.

Charge Events

Event	Trigger
apify-actor-start	Every run (base)
scorecard-run	action=scorecard for a single URL
batch-check	batchMode=true with 5+ URLs
remediation	action=remediation with includeRemediation=true

Platform costs (Apify's infrastructure fee) are passed through to the customer.

---

---

MCP Integration

This actor can be used through the Apify MCP server. Once connected, your MCP client (Claude Desktop, Cursor, etc.) can discover and run this actor from the Apify Store.

Quick Start

1. Install the Apify connector in your MCP client:

   • Claude Desktop: Search for "Apify" in the connector directory, or use the remote server at https://mcp.apify.com
   • Other clients: See the Apify MCP server docs for setup instructions

2. Ask your AI assistant to check security headers. For example:

   "Check the security headers on https://example.com" "Run a full scorecard on my production domain" "Scan these 10 URLs for missing HSTS headers" "Generate remediation steps for the CSP issues on our site"

Claude Desktop Configuration

Add the following to your claude_desktop_config.json:

{
  "mcpServers": {
    "apify": {
      "url": "https://mcp.apify.com"
    }
  }
}

On first connection, your browser opens to sign in to Apify and authorize access.

Bearer token alternative: For headless environments, CI/CD pipelines, or clients without browser-based OAuth, you can authenticate directly with your Apify API token:

{
  "mcpServers": {
    "apify": {
      "url": "https://mcp.apify.com",
      "headers": {
        "Authorization": "Bearer YOUR_APIFY_TOKEN"
      }
    }
  }
}

Get your API token from Apify Console → API & Integrations section.

---

Related Tools

• Cron Expression Builder & Validator — Automate periodic security header audits with scheduled cron-based scans across your infrastructure.
• Subdomain Enumeration via CT — Discover new subdomains that may need security header coverage as your attack surface grows.
• Website Tech Stack Detector — Correlate detected server technologies with missing or misconfigured security headers for targeted remediation.
• Phishing URL Risk Scorer — Combine header analysis with multi-factor URL risk scoring for comprehensive phishing investigation.