Security Headers Checker - HSTS, CSP, Cookies, Grade A+ to F

Check the HTTP security headers of hundreds of websites in one run and get an A+ to F grade with the exact fixes: HSTS, Content-Security-Policy, clickjacking protection, nosniff, Referrer-Policy, Permissions-Policy, cookie flags, version leaks and the HTTP to HTTPS redirect.

• Real checks, not just "present or missing". HSTS max-age under 6 months, CSP with 'unsafe-inline' or 'unsafe-eval' (a nonce or hash is accepted), Referrer-Policy values that leak URLs, Server headers that reveal a version.
• Cookies without leaking them. You get how many cookies lack Secure, HttpOnly or SameSite, never their names or values.
• HTTPS redirect. Each site is also opened over http:// to check that it redirects to https://.
• Light and polite. Only headers are read, no page content. $1 per 1,000 sites.

What can I use it for?

• Security audits and pentest scoping: grade all the domains and subdomains of a company in minutes.
• Agencies and freelancers: check your clients' sites before and after a hardening job, and show the grade.
• Compliance evidence: schedule a weekly run and keep the history (ISO 27001, SOC 2, PCI DSS reviews).
• Prospecting: find companies with weak web security for your security services.

Input

{ "urls": ["github.com", "example.com", "https://shop.example.com"] }

Output

One row per website. Example from a real run (CSP shortened):

{
    "url": "https://github.com/",
    "finalUrl": "https://github.com/",
    "status": 200,
    "score": 93,
    "grade": "A",
    "issues": [
        "No Permissions-Policy: camera, microphone and other features are not restricted.",
        "1 cookie(s) without HttpOnly (readable by scripts)."
    ],
    "https": true,
    "httpRedirectsToHttps": true,
    "missing": ["permissions-policy"],
    "headers": {
        "strict-transport-security": "max-age=31536000; includeSubdomains; preload",
        "content-security-policy": "default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-c…",
        "x-frame-options": "deny",
        "x-content-type-options": "nosniff",
        "referrer-policy": "origin-when-cross-origin, strict-origin-when-cross-origin",
        "server": "github.com"
    },
    "cookies": { "count": 3, "withoutSecure": 0, "withoutHttpOnly": 1, "withoutSameSite": 0 },
    "error": null
}

Grading: the score starts at 100 and loses points for each problem.

Problem	Points lost
Not served over HTTPS	30
No Content-Security-Policy	20
No HSTS	15
No clickjacking protection, no nosniff, http:// not redirected	10 each
HSTS under 6 months, CSP unsafe-inline or unsafe-eval, no Referrer-Policy, no Permissions-Policy, cookies without Secure	5 each
Leaky Referrer-Policy, version in Server, X-Powered-By, X-AspNet-Version	3 each
Cookies without HttpOnly, without SameSite	2 each

The grade is A from 90 points (A+ at 95 with HTTPS, HSTS and a CSP without unsafe sources), B from 75, C from 60 and D from 40.

Pricing

$0.001 per site checked ($1 per 1,000 sites) plus Apify's small run-start fee. No subscription, lower prices on higher Apify plans. Invalid inputs, unreachable sites and internal addresses are free.

Use it from AI agents (MCP)

Add security-headers-checker to the Apify MCP server in your MCP client (Claude, Cursor, VS Code...).

Integrations

Apify API, schedules, webhooks, Make, Zapier, n8n. Export as JSON, CSV, Excel or HTML.

Related tools

Same developer, same pay-per-result pricing, outputs that chain together:

• SSL Certificate Checker: SSL certificate expiry, issuer and chain of many hosts.
• Email Security Checker: SPF, DKIM, DMARC and MTA-STS of domains, with a grade.
• Website Tech Stack Detector: CMS, analytics, frameworks and SaaS tools of websites.

FAQ

Need the SSL certificate and email security too? Use SSL Certificate Checker and Email Security Checker.

Some sites answer 403. Sites behind an anti-bot wall may return a challenge page: its headers are graded, and the status field shows it.

Something wrong or missing? Open an issue on the Issues tab.