# Security Headers & TLS Checker - A-F Grade (`psx/security-headers-tls-audit`) Actor

Passive bulk check of HSTS, CSP, cookie flags, HTTPS redirect, TLS versions and certificate expiry. A-F grade with prioritised fix recommendations.

- **URL**: https://apify.com/psx/security-headers-tls-audit.md
- **Developed by:** [psx](https://apify.com/psx) (community)
- **Categories:** Developer tools, Automation, Business
- **Stats:** 3 total users, 2 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

Pay per event

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Website Security Headers + TLS Audit - A-F grade (HSTS, CSP, cookies, certificate expiry)

Check the security posture of any website in seconds, without credentials and without active attacks. For each URL you get a **grade (A-F)**, a **score**, and a prioritised list of **findings with fix recommendations**:

- **HTTP security headers**: Strict-Transport-Security (max-age, includeSubDomains), Content-Security-Policy (missing, unsafe-inline/eval, wildcards), clickjacking protection, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, CORS misconfiguration, information-leaking headers (Server version, X-Powered-By).
- **Cookies**: Secure / HttpOnly / SameSite flags (values are redacted, never stored).
- **TLS**: certificate expiry, trust chain, hostname match, key strength, negotiated protocol/cipher, and which protocol versions (TLS 1.0 / 1.1 / 1.2 / 1.3) the server accepts.
- **HTTPS**: HTTP to HTTPS redirect, `security.txt` (RFC 9116), CAA record present.

### Use cases

- Agencies and freelancers: prospect lists and client reports ("your site gets a D, here is why").
- Security and compliance teams (NIS2, ISO 27001 evidence): scheduled checks across a domain portfolio, alert on expiring certificates.
- Procurement and vendor risk screening at scale.
- AI agents (MCP): one JSON record per site.

### Input

| Field | Default | Description |
|---|---|---|
| `urls` | required | Up to 1000 sites or bare domains. |
| `checkTls` | `true` | Certificate and protocol-version checks. |
| `checkCookies` | `true` | Cookie flags. |
| `checkRedirect` | `true` | HTTP to HTTPS redirect check. |
| `checkSecurityTxt` | `true` | `/.well-known/security.txt`. |
| `concurrency` | `5` | Sites in parallel (max 20); one host at a time. |
| `respectRobots` | `true` | Skip sites whose robots.txt disallows the path for this bot. |

```json
{ "urls": ["https://github.com", "example.com"] }
```

### Output (one item per site)

```json
{
  "url": "https://github.com/", "status": 200, "grade": "A", "score": 94,
  "counts": { "high": 0, "medium": 0, "low": 2, "info": 1 },
  "findings": [{ "id": "permissions-policy-missing", "severity": "low", "title": "Permissions-Policy missing",
                 "detail": "...", "recommendation": "Send Permissions-Policy: camera=(), microphone=(), geolocation=()." }],
  "tls": { "protocol": "TLSv1.3", "validTo": "2027-02-05T23:59:59.000Z", "issuer": "Sectigo Limited",
           "supported": { "TLSv1": false, "TLSv1_1": false, "TLSv1_2": true, "TLSv1_3": true } },
  "httpsRedirect": { "status": 301, "redirectsToHttps": true }, "securityTxt": true, "caa": true
}
```

The score starts at 100 and subtracts a penalty per distinct finding (high 20, medium 8, low 3); plain-HTTP sites and invalid certificates are capped. It is a heuristic for ranking, not a certification.

### Pricing (pay per event)

| Event | When charged | Price |
|---|---|---|
| `apify-actor-start` | once per run | $0.005 |
| `site-audited` | each site successfully audited | $0.008 (= $8 per 1,000 sites) |

**Why this price:** competing Store actors range from $0.50 to $20 per 1,000 sites; the cheap ones check only headers or only certificates. This one combines headers, cookie flags, CSP weaknesses, HTTPS redirect, TLS protocol versions, certificate expiry, security.txt and CAA with a single grade and fix text. Example: a 500-domain portfolio = $4 per scan; a daily expiry monitor over 50 domains = about $12/month.

### Safety and politeness

- Passive only: one normal GET (plus robots.txt, HTTP-redirect probe, security.txt) and a handful of standard TLS handshakes per site. No scanning of ports, no payloads, no exploitation. Use it on sites you own or are permitted to assess.
- Identifies as `SecurityHeadersAudit`; one host is never checked concurrently; robots.txt respected.
- SSRF protection: http/https only; localhost, internal hostnames and private/reserved IPs are refused (checked at connect time and on each redirect).

### FAQ

**Is this a vulnerability scanner?**\
No. It is a passive posture check: one normal GET, a redirect probe, security.txt and a few standard TLS handshakes. No port scans or payloads.

**Can I use it on any site?**\
Use it on sites you own or are permitted to assess. It respects robots.txt by default.

**How is the grade calculated?**\
Score starts at 100 and subtracts 20/8/3 per distinct high/medium/low finding; plain HTTP and invalid certificates are capped. It is a ranking heuristic, not a certification.

**Can I monitor certificate expiry?**\
Yes. Schedule the Actor and alert on `tls.validTo` via webhook or the API.

**Does it help with NIS2 or ISO 27001?**\
It produces evidence of baseline hardening and certificate hygiene across many domains. It does not replace an audit.

### Part of the Site Audit Suite

Run the same list of domains through every audit:

- [Website Tech Stack Detector](https://apify.com/psx/tech-stack-detector)
- [Website Accessibility Audit (WCAG 2.2 + EAA)](https://apify.com/psx/accessibility-eaa-audit)
- [Broken Link Checker + On-Page SEO Audit](https://apify.com/psx/broken-link-seo-audit)
- llms.txt Generator and Sitemap + robots.txt Analyzer (coming soon)

Tip: pipe one domain list into several actors with an Apify Task or the API and join the results by `url`.

### Develop

```bash
npm install && npm test
mkdir -p storage/key_value_stores/default
echo '{"urls":["https://example.com"]}' > storage/key_value_stores/default/INPUT.json
npm start          # results in storage/datasets/default/
docker build -t security-headers-tls-audit .
```

Deploy (needs Apify account): `npx apify-cli login && npx apify-cli push`.

### Verified (2026-10-05, local)

github.com A/94, bbc.com C/71, example.com F (TLS 1.0/1.1 accepted, confirmed with openssl), expired.badssl.com F (expired + untrusted cert), http-only site capped at E. Docker: `docker run --user 996 -v <dir>:/usr/src/app/storage security-headers-tls-audit`.

# Actor input Schema

## `urls` (type: `array`):

Sites to check (up to 1000). Bare domains like example.com are accepted. Only audit sites you own or are allowed to test; checks are passive (one normal GET, TLS handshakes).

## `checkTls` (type: `boolean`):

Inspect the certificate (expiry, trust, hostname) and which TLS versions the server accepts (a few extra standard handshakes).

## `checkCookies` (type: `boolean`):

Check Secure / HttpOnly / SameSite on cookies set by the page. Values are never stored.

## `checkRedirect` (type: `boolean`):

One extra request to http://host/ without following the redirect.

## `checkSecurityTxt` (type: `boolean`):

Look for /.well-known/security.txt (RFC 9116).

## `concurrency` (type: `integer`):

Sites checked in parallel (max 20). A given host is never checked more than once at a time.

## `respectRobots` (type: `boolean`):

Skip the site if robots.txt disallows the requested path for this bot.

## Actor input object example

```json
{
  "urls": [
    "https://github.com",
    "https://example.com"
  ],
  "checkTls": true,
  "checkCookies": true,
  "checkRedirect": true,
  "checkSecurityTxt": true,
  "concurrency": 5,
  "respectRobots": true
}
```

# Actor output Schema

## `results` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "urls": [
        "https://github.com",
        "https://example.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("psx/security-headers-tls-audit").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "urls": [
        "https://github.com",
        "https://example.com",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("psx/security-headers-tls-audit").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "urls": [
    "https://github.com",
    "https://example.com"
  ]
}' |
apify call psx/security-headers-tls-audit --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,psx/security-headers-tls-audit"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/e2tJsUwqsabreQoB6/builds/7TbCH4vwC8Xiy1Iqs/openapi.json