Website Security Headers + TLS Audit - A-F grade (HSTS, CSP, cookies, certificate expiry)

Check the security posture of any website in seconds, without credentials and without active attacks. For each URL you get a grade (A-F), a score, and a prioritised list of findings with fix recommendations:

• HTTP security headers: Strict-Transport-Security (max-age, includeSubDomains), Content-Security-Policy (missing, unsafe-inline/eval, wildcards), clickjacking protection, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, CORS misconfiguration, information-leaking headers (Server version, X-Powered-By).
• Cookies: Secure / HttpOnly / SameSite flags (values are redacted, never stored).
• TLS: certificate expiry, trust chain, hostname match, key strength, negotiated protocol/cipher, and which protocol versions (TLS 1.0 / 1.1 / 1.2 / 1.3) the server accepts.
• HTTPS: HTTP to HTTPS redirect, security.txt (RFC 9116), CAA record present.

Use cases

• Agencies and freelancers: prospect lists and client reports ("your site gets a D, here is why").
• Security and compliance teams (NIS2, ISO 27001 evidence): scheduled checks across a domain portfolio, alert on expiring certificates.
• Procurement and vendor risk screening at scale.
• AI agents (MCP): one JSON record per site.

Input

Field	Default	Description
urls	required	Up to 1000 sites or bare domains.
checkTls	true	Certificate and protocol-version checks.
checkCookies	true	Cookie flags.
checkRedirect	true	HTTP to HTTPS redirect check.
checkSecurityTxt	true	/.well-known/security.txt.
concurrency	5	Sites in parallel (max 20); one host at a time.
respectRobots	true	Skip sites whose robots.txt disallows the path for this bot.

{ "urls": ["https://github.com", "example.com"] }

Output (one item per site)

{
  "url": "https://github.com/", "status": 200, "grade": "A", "score": 94,
  "counts": { "high": 0, "medium": 0, "low": 2, "info": 1 },
  "findings": [{ "id": "permissions-policy-missing", "severity": "low", "title": "Permissions-Policy missing",
                 "detail": "...", "recommendation": "Send Permissions-Policy: camera=(), microphone=(), geolocation=()." }],
  "tls": { "protocol": "TLSv1.3", "validTo": "2027-02-05T23:59:59.000Z", "issuer": "Sectigo Limited",
           "supported": { "TLSv1": false, "TLSv1_1": false, "TLSv1_2": true, "TLSv1_3": true } },
  "httpsRedirect": { "status": 301, "redirectsToHttps": true }, "securityTxt": true, "caa": true
}

The score starts at 100 and subtracts a penalty per distinct finding (high 20, medium 8, low 3); plain-HTTP sites and invalid certificates are capped. It is a heuristic for ranking, not a certification.

Pricing (pay per event)

Event	When charged	Price
apify-actor-start	once per run	$0.005
site-audited	each site successfully audited	$0.008 (= $8 per 1,000 sites)

Why this price: competing Store actors range from $0.50 to $20 per 1,000 sites; the cheap ones check only headers or only certificates. This one combines headers, cookie flags, CSP weaknesses, HTTPS redirect, TLS protocol versions, certificate expiry, security.txt and CAA with a single grade and fix text. Example: a 500-domain portfolio = $4 per scan; a daily expiry monitor over 50 domains = about $12/month.

Safety and politeness

• Passive only: one normal GET (plus robots.txt, HTTP-redirect probe, security.txt) and a handful of standard TLS handshakes per site. No scanning of ports, no payloads, no exploitation. Use it on sites you own or are permitted to assess.
• Identifies as SecurityHeadersAudit; one host is never checked concurrently; robots.txt respected.
• SSRF protection: http/https only; localhost, internal hostnames and private/reserved IPs are refused (checked at connect time and on each redirect).

FAQ

Is this a vulnerability scanner?
No. It is a passive posture check: one normal GET, a redirect probe, security.txt and a few standard TLS handshakes. No port scans or payloads.

Can I use it on any site?
Use it on sites you own or are permitted to assess. It respects robots.txt by default.

How is the grade calculated?
Score starts at 100 and subtracts 20/8/3 per distinct high/medium/low finding; plain HTTP and invalid certificates are capped. It is a ranking heuristic, not a certification.

Can I monitor certificate expiry?
Yes. Schedule the Actor and alert on tls.validTo via webhook or the API.

Does it help with NIS2 or ISO 27001?
It produces evidence of baseline hardening and certificate hygiene across many domains. It does not replace an audit.

Part of the Site Audit Suite

Run the same list of domains through every audit:

• Website Tech Stack Detector
• Website Accessibility Audit (WCAG 2.2 + EAA)
• Broken Link Checker + On-Page SEO Audit
• llms.txt Generator and Sitemap + robots.txt Analyzer (coming soon)

Tip: pipe one domain list into several actors with an Apify Task or the API and join the results by url.

Develop

npm install && npm test
mkdir -p storage/key_value_stores/default
echo '{"urls":["https://example.com"]}' > storage/key_value_stores/default/INPUT.json
npm start          # results in storage/datasets/default/
docker build -t security-headers-tls-audit .

Deploy (needs Apify account): npx apify-cli login && npx apify-cli push.

Verified (2026-10-05, local)

github.com A/94, bbc.com C/71, example.com F (TLS 1.0/1.1 accepted, confirmed with openssl), expired.badssl.com F (expired + untrusted cert), http-only site capped at E. Docker: docker run --user 996 -v <dir>:/usr/src/app/storage security-headers-tls-audit.