HTTP Security Headers & Posture Checker

A direct website security preflight: URLs in, structured HTTP security posture out. Drift monitoring is optional rather than the core entry point. Returns structured, machine-readable results for repeatable research, monitoring, automation, Apify Tasks, API workflows, and AI agents..

Quick start

Start with this working example and replace the target values with your own:

{
  "urls": [
    "https://www.python.org"
  ],
  "maxUrls": 10
}

The Actor writes structured results to the default Apify Dataset and can be used from the Store, API, schedules, Tasks, automations and MCP-compatible AI workflows.

Input

• urls — Public URLs: Public HTTP(S) targets to audit.
• url — Single URL: Optional single public target.
• maxUrls — Maximum URLs: Maximum targets in one run.
• previousSnapshots — Previous snapshots: Optional map from URL to prior snapshot for regression detection.
• failRunOnCritical — Fail on critical posture: Fail after writing results if any target is critical.
• failRunOnRegression — Fail on regression: Fail after writing results if posture deteriorates.

All integration and advanced analysis fields are optional. The default example is intentionally runnable without configuring MCP or a previous-run baseline.

Output

The Dataset exposes predictable machine-readable output. Representative fields include results.

Pricing

This Actor uses Pay Per Event. The current factory base price is $0.006000 per result event. The Apify Store remains the source of truth for the price and plan/tier details shown to the buyer.

Use cases

• Run the buyer-ready workflows exposed as Apify Tasks without preparing a custom integration first.
• Use the Actor from API or schedules for recurring collection, comparison or monitoring.
• Feed the structured Dataset output into spreadsheets, databases, automations or AI agents.
• Compare repeat runs when the product supports snapshots or previous-run inputs.

Automation and AI

Use the same Actor through Apify API, schedules, public Tasks and the Apify MCP server. Outputs are structured for downstream workflows and AI agents rather than requiring manual copy/paste.

Limitations

• Public websites and upstream APIs can change markup, access rules, rate limits or field availability without notice.
• Fields that are not publicly available are returned as unavailable or omitted rather than fabricated.
• Analytical outputs depend on the quality and coverage of the supplied or collected source data.
• Treat marketplace, reputation, workforce, safety or commercial signals as decision support and validate material decisions against the underlying source evidence.

Detailed documentation

Detailed documentation

Give public URLs. Check HTTP security headers and posture, return structured risks and scores, with optional regression comparison across runs.

Why use this Actor

A site can pass a header audit today and regress tomorrow after a CDN, framework, reverse proxy or deployment change. Security teams also need to know whether TLS certificates are expiring, cookies lost protective flags, CORS became dangerous, or a security.txt contact disappeared. This Actor produces one normalized posture record per target and makes those records reusable as baselines.

Key features

• Weighted security-header posture across HSTS, CSP, frame protection, referrer policy, permissions policy and cross-origin isolation headers.
• TLS protocol and certificate-expiry evidence.
• Cookie Secure, HttpOnly and SameSite checks.
• CORS probe for dangerous wildcard-plus-credentials behavior.
• .well-known/security.txt presence and basic validity check.
• Posture score, grade, severity, regression delta and deterministic baseline fingerprint.
• Multi-domain portfolio average, critical count and regression count.
• Related-framework hints for OWASP, CIS, NIST and PCI DSS without pretending to certify compliance.
• agentAction and agentReason fields for automation and AI-agent routing.

Input

Provide one or more public URLs. For recurring monitoring, feed previous snapshots back through previousSnapshots. Optional gates can fail a run after results are written when a critical posture or regression is detected.

Output

One structured row per target containing posture score, grade, severity, header evidence, TLS evidence, cookie findings, CORS findings, security.txt evidence, portfolio context, reusable snapshot and recommended action.

Example

Audit https://www.python.org, save its currentSnapshot, then reuse that object on a later scheduled run to detect posture deterioration.

Use cases

DevSecOps release gates, security hygiene monitoring, vendor and third-party risk, agency/MSSP portfolio checks, due-diligence evidence, certificate-expiry monitoring, public-surface compliance evidence and AI-agent remediation workflows.

Pricing

Pay per audited target result. The Actor uses a lean HTTP-first runtime and avoids browser or paid-LLM costs for the normal path.

Limitations

This is not penetration testing, vulnerability exploitation, authenticated scanning or a compliance certification. Public responses can vary by geography, CDN, authentication and HTTP method. Framework mappings indicate related controls only.

Agent execution and AI discovery (October 2026)

Use this Actor when: A direct website security preflight: URLs in, structured HTTP security posture out. Drift monitoring is optional rather than the core entry point. Returns structured, machine-readable results for repeatable research, monitoring,...

For AI agents and automations:

• Find this Actor in Apify Store by its use case and verify its actual input and pricing through Apify MCP (search-actors and fetch-actor-details). Availability and ranking in Apify AI are controlled by Apify; discovery is not guaranteed.
• Read the Input tab or input schema. Recognized fields include urls, url, maxUrls, previousSnapshots, failRunOnCritical, failRunOnRegression, concurrency, minimumPostureScore. Required fields: See the Input tab for valid example values. Do not invent records or credentials.
• Supply a small representative input first. Use Apify API, Tasks, or MCP to run and retrieve the structured dataset; inspect the output schema rather than assuming all inputs produce the same rows.
• For programmatic calls, set timeouts and maxTotalChargeUsd in run options to limit exposure. Check the Apify Pricing tab for billable events and discounts.
• Payment compatibility: this Actor is published with limited permissions and pay-per-event pricing. Apify AGI prepaid x402 tokens can execute limited-permission Actors. Direct per-request payment is a separate, conditional feature that may require additional eligibility checks and creator verification. Do not interpret this paragraph as proof of approved KYC or guaranteed payment acceptance.
• This Actor does not independently guarantee real-time access to a third-party source. Verify input provenance and important conclusions, and do not supply confidential personal data unnecessarily.