# Security Headers Checker - HSTS, CSP, Cookies, Grade A+ to F (`propped_cloak/security-headers-checker`) Actor

Check the HTTP security headers of many websites: HSTS, CSP, X-Frame-Options, nosniff, Referrer and Permissions policies, cookie flags, HTTPS redirect. A+ to F grade with fixes. $1 per 1,000 sites.

- **URL**: https://apify.com/propped_cloak/security-headers-checker.md
- **Developed by:** [Emmanuel Vingadassalon](https://apify.com/propped_cloak) (community)
- **Categories:** Developer tools, Automation, SEO tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $0.80 / 1,000 site checkeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Security Headers Checker - HSTS, CSP, Cookies, Grade A+ to F

Check the **HTTP security headers of hundreds of websites** in one run and get an **A+ to F grade with the exact fixes**: HSTS, Content-Security-Policy, clickjacking protection, `nosniff`, Referrer-Policy, Permissions-Policy, cookie flags, version leaks and the HTTP to HTTPS redirect.

- **Real checks, not just "present or missing".** HSTS `max-age` under 6 months, CSP with `'unsafe-inline'` or `'unsafe-eval'` (a nonce or hash is accepted), `Referrer-Policy` values that leak URLs, `Server` headers that reveal a version.
- **Cookies without leaking them.** You get how many cookies lack `Secure`, `HttpOnly` or `SameSite`, never their names or values.
- **HTTPS redirect.** Each site is also opened over `http://` to check that it redirects to `https://`.
- **Light and polite.** Only headers are read, no page content. **$1 per 1,000 sites.**

### What can I use it for?

- **Security audits and pentest scoping:** grade all the domains and subdomains of a company in minutes.
- **Agencies and freelancers:** check your clients' sites before and after a hardening job, and show the grade.
- **Compliance evidence:** schedule a weekly run and keep the history (ISO 27001, SOC 2, PCI DSS reviews).
- **Prospecting:** find companies with weak web security for your security services.

### Input

```json
{ "urls": ["github.com", "example.com", "https://shop.example.com"] }
```

### Output

One row per website. Example from a real run (CSP shortened):

```json
{
    "url": "https://github.com/",
    "finalUrl": "https://github.com/",
    "status": 200,
    "score": 93,
    "grade": "A",
    "issues": [
        "No Permissions-Policy: camera, microphone and other features are not restricted.",
        "1 cookie(s) without HttpOnly (readable by scripts)."
    ],
    "https": true,
    "httpRedirectsToHttps": true,
    "missing": ["permissions-policy"],
    "headers": {
        "strict-transport-security": "max-age=31536000; includeSubdomains; preload",
        "content-security-policy": "default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-c…",
        "x-frame-options": "deny",
        "x-content-type-options": "nosniff",
        "referrer-policy": "origin-when-cross-origin, strict-origin-when-cross-origin",
        "server": "github.com"
    },
    "cookies": { "count": 3, "withoutSecure": 0, "withoutHttpOnly": 1, "withoutSameSite": 0 },
    "error": null
}
```

**Grading:** the score starts at 100 and loses points for each problem.

| Problem | Points lost |
|---|---|
| Not served over HTTPS | 30 |
| No Content-Security-Policy | 20 |
| No HSTS | 15 |
| No clickjacking protection, no `nosniff`, `http://` not redirected | 10 each |
| HSTS under 6 months, CSP `unsafe-inline` or `unsafe-eval`, no Referrer-Policy, no Permissions-Policy, cookies without `Secure` | 5 each |
| Leaky Referrer-Policy, version in `Server`, `X-Powered-By`, `X-AspNet-Version` | 3 each |
| Cookies without `HttpOnly`, without `SameSite` | 2 each |

The grade is A from 90 points (A+ at 95 with HTTPS, HSTS and a CSP without unsafe sources), B from 75, C from 60 and D from 40.

### Pricing

**$0.001 per site checked ($1 per 1,000 sites)** plus Apify's small run-start fee. No subscription, lower prices on higher Apify plans. Invalid inputs, unreachable sites and internal addresses are free.

### Use it from AI agents (MCP)

Add `security-headers-checker` to the [Apify MCP server](https://mcp.apify.com) in your MCP client (Claude, Cursor, VS Code...).

### Integrations

Apify API, schedules, webhooks, Make, Zapier, n8n. Export as JSON, CSV, Excel or HTML.

### Related tools

Same developer, same pay-per-result pricing, outputs that chain together:

- [SSL Certificate Checker](https://apify.com/propped_cloak/ssl-certificate-checker): SSL certificate expiry, issuer and chain of many hosts.
- [Email Security Checker](https://apify.com/propped_cloak/email-security-checker): SPF, DKIM, DMARC and MTA-STS of domains, with a grade.
- [Website Tech Stack Detector](https://apify.com/propped_cloak/website-tech-detector): CMS, analytics, frameworks and SaaS tools of websites.

### FAQ

**Need the SSL certificate and email security too?** Use [SSL Certificate Checker](https://apify.com/propped_cloak/ssl-certificate-checker) and [Email Security Checker](https://apify.com/propped_cloak/email-security-checker).

**Some sites answer 403.** Sites behind an anti-bot wall may return a challenge page: its headers are graded, and the `status` field shows it.

**Something wrong or missing?** Open an issue on the Issues tab.

# Actor input Schema

## `urls` (type: `array`):

Domains or URLs, one per line. Only response headers are read: no page content is downloaded. Duplicates are removed.

## Actor input object example

```json
{
  "urls": [
    "github.com",
    "example.com",
    "wordpress.org"
  ]
}
```

# Actor output Schema

## `results` (type: `string`):

One row per website: grade A+ to F, score, issues to fix, security headers found, cookie flags and HTTPS redirect.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "urls": [
        "github.com",
        "example.com",
        "wordpress.org"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("propped_cloak/security-headers-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "urls": [
        "github.com",
        "example.com",
        "wordpress.org",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("propped_cloak/security-headers-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "urls": [
    "github.com",
    "example.com",
    "wordpress.org"
  ]
}' |
apify call propped_cloak/security-headers-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,propped_cloak/security-headers-checker"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/0Oqx4ACmUYpdaexm7/builds/e0Cmoke1wHsHNq4SY/openapi.json