# SSL Certificate and Security Headers Checker API (`rowcraft/ssl-security-headers-checker`) Actor

Check the TLS certificate and the HTTP security headers of every domain in one run, with an A+ to F grade and the exact issues to fix. Expiry, chain trust, HSTS, CSP and more from one handshake and a few polite requests per domain. robots.txt obeyed, no personal data, pay only per domain.

- **URL**: https://apify.com/rowcraft/ssl-security-headers-checker.md
- **Developed by:** [Rowcraft](https://apify.com/rowcraft) (community)
- **Categories:** Developer tools, SEO tools
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $0.60 / 1,000 domain checkeds

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## SSL Certificate and Security Headers Checker API

Check the **SSL certificate** and the **security headers** of a list of domains in one run. For every domain the actor reads the TLS certificate (who issued it, when it ends, whether the chain is trusted, whether it fits the host name), the protocol and cipher the server negotiates, and the security headers of the home page (HSTS, Content-Security-Policy, X-Frame-Options and six more), and it returns one flat row with a grade from A+ to F, the exact issues behind the grade and the list of headers that are missing, as JSON, CSV or Excel.

The grade follows a formula that is written out in full below, so you can check any result by hand and explain it to a client. Run it once to audit a list of sites, or on a schedule with **Only new rows** turned on to watch certificate expiry: a domain is delivered again only when its certificate, its grade or its expiry state changed.

![Input form of SSL Certificate and Security Headers Checker API](https://api.apify.com/v2/key-value-stores/7hbQFQdGq61v2OZ2h/records/ssl-security-headers-checker-input.png)

### What you get

One row per domain whose certificate could be read:

- **Grade and score:** `securityGrade` (A+, A, B, C, D, E, F), the `securityScore` behind it (0 to 100), the number of issues and the issues in plain words, for example `Content-Security-Policy missing; certificate expires in 12 days`
- **Certificate:** common name, issuing organisation and name, valid from and to (ISO 8601), `daysLeft`, `expired`, `expiresSoon`, `selfSigned`, key type and size, signature algorithm, the number of names in the certificate and the first ten, a SHA-256 fingerprint that changes when the certificate is renewed
- **Trust:** `chainTrusted` with the reason when it is not (an expired certificate, a missing intermediate, an unknown root), `hostnameMatch`, and whether the server staples an OCSP response
- **Connection:** the TLS protocol and the cipher suite negotiated
- **Security headers of the home page:** Strict-Transport-Security (max-age, includeSubDomains, preload), Content-Security-Policy (present, and the first 300 characters), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy, Cross-Origin-Resource-Policy, plus the Server and X-Powered-By headers
- **Redirect:** whether `http://` sends visitors to `https://`
- **Missing headers:** the recommended headers the page does not send, as one comma-separated text

The run also writes a `COVERAGE` record with one line per domain you asked for (ok, tls_only, no_tls, not_found, error or not_checked, with the reason) and a `RUN_SUMMARY` with the grade counts, the certificates that expired or expire soon, and why the run stopped.

### Why this actor

- **Certificate and headers in one row.** The two checks that site owners, agencies and security teams run together are delivered together, with one grade, so a spreadsheet or a dashboard needs no join.
- **A grade you can explain.** Every deduction is listed in the formula below and repeated in the `issues` column of the row. Nothing is hidden in a score that only the tool can reproduce.
- **Built for expiry monitoring.** `daysLeft`, `expiresSoon` and `expired` are columns, the warning window is an input, and the run summary lists the certificates that need attention first. With **Only new rows** on, a schedule costs only the domains that changed.
- **Honest about what it could not read.** If robots.txt refuses the home page or an anti-bot page answers, the row still carries the certificate and says in `headersNote` why the headers are missing; the grade is not guessed.
- **Pay only for domains checked.** Domains without TLS, domains that do not exist, invalid or repeated entries and domains skipped by **Only new rows** are never charged.
- **Polite by design.** robots.txt is read and obeyed before any page is requested, there is a pause between requests to the same host, and the page body is not even downloaded: the connection is closed as soon as the headers are in.

### How to use it

1. Open the Actor and paste your domains into **Domains or URLs**, one per line. A column copied from a spreadsheet works, and so do entries separated by commas.
2. Keep **Also check the security headers** on for the grade, or turn it off for a certificate-only check that sends no HTTP request at all.
3. Set **Warn when a certificate expires within (days)** to the lead time you need to renew (30 by default).
4. Click **Start**. The status line shows progress; the run stops cleanly at your maximum or at the charge limit you set in the run options.
5. Open the **Dataset** tab: the **Overview**, **Certificates** and **Security headers** views show the main columns. Download JSON, CSV, Excel, XML or HTML, or send the rows to Google Sheets, Slack, Make, n8n or Zapier with the Integrations tab.
6. Open the `COVERAGE` record in the key-value store to see which domains could not be checked and why, and `RUN_SUMMARY` for the grade counts and the certificates that expire soon.

### Input

| Field | What it does |
|---|---|
| `domains` | Domains (`example.com`), addresses (`https://www.example.com/shop`) or domains with a port (`example.com:8443`), one per line. The host is checked exactly as written: `example.com` and `www.example.com` can carry different certificates, so no `www.` is added or removed. Up to 100,000 per run. |
| `checkHeaders` | On by default. Reads robots.txt and the home page for the headers, checks the redirect from `http://`, and gives the grade. Off = certificate only, no HTTP request. |
| `expiryWarningDays` | Certificates with this many days left or fewer get `expiresSoon = true`. Default 30. |
| `maxItems` | Stop after this many delivered rows. 0 = the whole list. |
| `port` | The port where the certificate is read, 443 for websites. A port written in an entry wins over this value. |
| `onlyNew`, `stateName` | Deliver a domain only when its certificate, its grade or its expiry state changed since the last run with the same state name |
| `notifyUrl`, `notifyWhenEmpty` | A webhook that receives one message when the run ends; see **Automation** below |
| `requestIntervalMs` | Minimum pause between two requests to the same host, default 1000 ms, minimum 250 ms |

Example: three websites, one row each.

```json
{
  "domains": ["github.com", "wikipedia.org", "example.com"]
}
```

Example: a daily certificate watch that warns 21 days ahead and reports only what changed, with a Slack message.

```json
{
  "domains": ["shop.example.com", "www.example.com", "api.example.com"],
  "expiryWarningDays": 21,
  "onlyNew": true,
  "stateName": "certificate-watch",
  "notifyUrl": "https://hooks.slack.com/services/..."
}
```

### Output

52 fields per row. Empty values are `null`, never missing, so CSV and Excel columns are stable.

| Field | Type | Example |
|---|---|---|
| `id` | string | github.com |
| `host` | string | github.com |
| `port` | integer | 443 |
| `securityGrade` | string | A |
| `securityScore` | integer | 90 |
| `issueCount` | integer | 4 |
| `issues` | string | Permissions-Policy missing; Cross-Origin-Opener-Policy missing; Cro… |
| `protocol` | string | TLSv1.3 |
| `cipher` | string | TLS_AES_128_GCM_SHA256 |
| `subjectCN` | string | github.com |
| `issuerO` | string | Sectigo Limited |
| `issuerCN` | string | Sectigo Public Server Authentication CA DV E36 |
| `validFrom` | string | 2026-09-01T00:00:00.000Z |
| `validTo` | string | 2026-11-29T23:59:59.000Z |
| `daysLeft` | integer | 45 |
| `expiresSoon` | boolean | False |
| `expired` | boolean | False |
| `selfSigned` | boolean | False |
| `chainTrusted` | boolean | True |
| `chainError` | string | CERT_HAS_EXPIRED |
| `hostnameMatch` | boolean | True |
| `sanCount` | integer | 2 |
| `sanSample` | string | github.com, www.github.com |
| `keyType` | string | EC |
| `keyBits` | integer | 256 |
| `signatureAlgorithm` | string | ecdsa-with-SHA256 |
| `ocspStapling` | boolean | False |
| `chainLength` | integer | 4 |
| `certFingerprint` | string | 46b601ee08b418cf8a3a1ebfe670ba5ce43bb05a917fa8b2dd087a30471cfc63 |
| `headersChecked` | boolean | True |
| `headersNote` | string | headers not read: robots.txt of www.reddit.com disallows / for auto… |
| `finalUrl` | string | `https://github.com/` |
| `statusCode` | integer | 200 |
| `hsts` | boolean | True |
| `hstsMaxAge` | integer | 31536000 |
| `hstsIncludeSubDomains` | boolean | True |
| `hstsPreload` | boolean | True |
| `contentSecurityPolicy` | boolean | True |
| `contentSecurityPolicyPreview` | string | default-src 'none'; base-uri 'self'; child-src github.githubassets.… |
| `xFrameOptions` | string | deny |
| `xContentTypeOptions` | string | nosniff |
| `referrerPolicy` | string | origin-when-cross-origin, strict-origin-when-cross-origin |
| `permissionsPolicy` | string | geolocation=(), camera=(), microphone=() |
| `crossOriginOpenerPolicy` | string | same-origin |
| `crossOriginEmbedderPolicy` | string | require-corp |
| `crossOriginResourcePolicy` | string | cross-origin |
| `server` | string | github.com |
| `xPoweredBy` | string | Express |
| `httpToHttpsRedirect` | boolean | True |
| `missingHeaders` | string | Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Embedd… |
| `inputUrl` | string | github.com |
| `checkedAt` | string | 2026-10-15T20:19:39.427Z |

#### How the grade is calculated

The headers that count, and the values that are recommended for them, come from the [OWASP Secure Headers Project](https://owasp.org/www-project-secure-headers/) and the documentation of each header on [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers); HSTS follows [RFC 6797](https://www.rfc-editor.org/rfc/rfc6797). The points are Rowcraft's own weighting of those recommendations. The grade is therefore consistent and explainable, but it is not the grade another service would give the same site.

The score starts at 100 and loses points for each finding, never going below 0:

| Check | Points lost |
|---|---|
| `Strict-Transport-Security` missing (or `max-age=0`) | 25 |
| HSTS `max-age` under 15,552,000 seconds (180 days) | 10 |
| `Content-Security-Policy` missing | 25 |
| CSP present but it does not restrict scripts: no `script-src` or `default-src`, or it allows `'unsafe-inline'` (without a nonce, hash or `'strict-dynamic'`), `'unsafe-eval'`, a `*` wildcard, `data:` or `http:` | 10 |
| `X-Content-Type-Options` missing or not `nosniff` | 10 |
| No clickjacking protection: neither `X-Frame-Options` (`DENY` or `SAMEORIGIN`) nor a CSP `frame-ancestors` directive | 15 |
| `Referrer-Policy` missing, or `unsafe-url` | 5 |
| `Permissions-Policy` missing | 5 |
| `Cross-Origin-Opener-Policy` missing | 2 |
| `Cross-Origin-Embedder-Policy` missing | 2 |
| `Cross-Origin-Resource-Policy` missing | 1 |
| `Server` header with a version number (for example `nginx/1.18.0`) | 3 |
| `X-Powered-By` header present | 3 |
| `http://` answers with the page instead of redirecting to `https://` | 10 |

The grade comes from the score:

| Grade | Score |
|---|---|
| A+ | 95 or more, and an HSTS header that qualifies for the browsers' preload lists (`max-age` of at least 31,536,000 seconds, `includeSubDomains` and `preload`) |
| A | 85 to 94 (and 95 or more without the preload-ready HSTS) |
| B | 75 to 84 |
| C | 60 to 74 |
| D | 45 to 59 |
| E | 30 to 44 |
| F | under 30 |

The certificate can only lower the result. An expired certificate, one that is not valid yet, a self-signed or untrusted one (including a missing intermediate certificate) or one that does not match the host name caps the score at 29, which is an F, and gives an F even when the headers could not be read. An old protocol (TLS 1.0 or 1.1), a SHA-1 or MD5 signature or an RSA key under 2,048 bits caps the score at 74, which is a C. A certificate that is merely close to expiry adds an issue line and sets `expiresSoon`, but does not change the grade.

Every deduction appears in the `issues` column, so the score of a row can be added up from its text. When the headers were not read (robots.txt, an anti-bot page, an error, or **Also check the security headers** switched off) `securityScore` is empty and `securityGrade` is empty too, unless the certificate alone is a failure, which gives an F.

#### Example rows

Two real rows from a run (long texts shortened here, complete in the dataset):

```json
[
  {
    "id": "github.com",
    "host": "github.com",
    "port": 443,
    "securityGrade": "A",
    "securityScore": 90,
    "issueCount": 4,
    "issues": "Permissions-Policy missing; Cross-Origin-Opener-Policy missing; Cross-Origin-Embedder-Policy missing; Cross-Origin-Resource-Policy missing",
    "protocol": "TLSv1.3",
    "cipher": "TLS_AES_128_GCM_SHA256",
    "subjectCN": "github.com",
    "issuerO": "Sectigo Limited",
    "issuerCN": "Sectigo Public Server Authentication CA DV E36",
    "validFrom": "2026-09-01T00:00:00.000Z",
    "validTo": "2026-11-29T23:59:59.000Z",
    "daysLeft": 45,
    "expiresSoon": false,
    "expired": false,
    "selfSigned": false,
    "chainTrusted": true,
    "chainError": null,
    "hostnameMatch": true,
    "sanCount": 2,
    "sanSample": "github.com, www.github.com",
    "keyType": "EC",
    "keyBits": 256,
    "signatureAlgorithm": "ecdsa-with-SHA256",
    "ocspStapling": false,
    "chainLength": 4,
    "certFingerprint": "46b601ee08b418cf8a3a1ebfe670ba5ce43bb05a917fa8b2dd087a30471cfc63",
    "headersChecked": true,
    "headersNote": null,
    "finalUrl": "https://github.com/",
    "statusCode": 200,
    "hsts": true,
    "hstsMaxAge": 31536000,
    "hstsIncludeSubDomains": true,
    "hstsPreload": true,
    "contentSecurityPolicy": true,
    "contentSecurityPolicyPreview": "default-src 'none'; base-uri 'self'; child-src github.githubassets.com github.com/assets-cdn/worker/ github.com/assets/ gist.github.com/a…",
    "xFrameOptions": "deny",
    "xContentTypeOptions": "nosniff",
    "referrerPolicy": "origin-when-cross-origin, strict-origin-when-cross-origin",
    "permissionsPolicy": null,
    "crossOriginOpenerPolicy": null,
    "crossOriginEmbedderPolicy": null,
    "crossOriginResourcePolicy": null,
    "server": "github.com",
    "xPoweredBy": null,
    "httpToHttpsRedirect": true,
    "missingHeaders": "Permissions-Policy, Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy, Cross-Origin-Resource-Policy",
    "inputUrl": "github.com",
    "checkedAt": "2026-10-15T20:19:39.427Z"
  },
  {
    "id": "example.com",
    "host": "example.com",
    "port": 443,
    "securityGrade": "F",
    "securityScore": 0,
    "issueCount": 10,
    "issues": "Strict-Transport-Security missing: browsers may use plain http://; Content-Security-Policy missing; X-Content-Type-Options: nosniff missi…",
    "protocol": "TLSv1.3",
    "cipher": "TLS_AES_256_GCM_SHA384",
    "subjectCN": "example.com",
    "issuerO": "SSL Corporation",
    "issuerCN": "Cloudflare TLS Issuing ECC CA 3",
    "validFrom": "2026-09-26T22:49:11.000Z",
    "validTo": "2026-12-25T22:56:35.000Z",
    "daysLeft": 71,
    "expiresSoon": false,
    "expired": false,
    "selfSigned": false,
    "chainTrusted": true,
    "chainError": null,
    "hostnameMatch": true,
    "sanCount": 2,
    "sanSample": "example.com, *.example.com",
    "keyType": "EC",
    "keyBits": 256,
    "signatureAlgorithm": "ecdsa-with-SHA256",
    "ocspStapling": true,
    "chainLength": 5,
    "certFingerprint": "85ca6ab068e9bcce88b6c4aa3c47f7d17228134a457f870d3800e6223a0df07a",
    "headersChecked": true,
    "headersNote": null,
    "finalUrl": "https://example.com/",
    "statusCode": 200,
    "hsts": false,
    "hstsMaxAge": null,
    "hstsIncludeSubDomains": null,
    "hstsPreload": null,
    "contentSecurityPolicy": false,
    "contentSecurityPolicyPreview": null,
    "xFrameOptions": null,
    "xContentTypeOptions": null,
    "referrerPolicy": null,
    "permissionsPolicy": null,
    "crossOriginOpenerPolicy": null,
    "crossOriginEmbedderPolicy": null,
    "crossOriginResourcePolicy": null,
    "server": "cloudflare",
    "xPoweredBy": null,
    "httpToHttpsRedirect": false,
    "missingHeaders": "Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, Cross-O…",
    "inputUrl": "example.com",
    "checkedAt": "2026-10-15T20:19:38.860Z"
  }
]
```

Results can be downloaded as JSON, CSV, Excel, XML or HTML from the Dataset tab, or read through the Apify API.

![Results of SSL Certificate and Security Headers Checker API in the Apify dataset view](https://api.apify.com/v2/key-value-stores/7hbQFQdGq61v2OZ2h/records/ssl-security-headers-checker-results.png)

### Pricing

**Pay per result.** You pay for each domain checked and delivered to your dataset, nothing else: no subscription and no minimum.

| Your Apify plan | Price per 1,000 rows | Price per row |
|---|---|---|
| Free plan | **$0.80** | $0.0008 |
| Starter plan | **$0.70** | $0.0007 |
| Scale plan | **$0.65** | $0.00065 |
| Business plan and above | **$0.60** | $0.0006 |

Example: 1,000 domains cost $0.80 on the Free plan and $0.60 on the Business plan. The Apify platform usage of a run (compute and storage) is billed by Apify separately, as for every Actor; the actor runs in 256 MB and spends most of its time waiting for the servers.
A start event of $0.00005 is charged once per run (Apify default).
**Cap your spend:** set *Maximum total charge* in the run options. The actor stops cleanly when the cap is reached and you keep everything delivered until then. The run summary (`RUN_SUMMARY` in the key-value store) says why a run stopped.

A domain is charged when its certificate was read and the row was delivered, including a row that carries the certificate only because robots.txt or an anti-bot page kept the headers back. Domains without a TLS service, domains that do not exist, invalid or repeated entries, and domains skipped by **Only new rows** because nothing changed are not charged.

### Automation: only new rows, notifications, schedules

**Only new rows since the last run.** Turn on `onlyNew` and the actor remembers, for every domain it delivered to you, the certificate fingerprint, the grade and the expiry state (in a key-value store named `rowcraft-ssl-security-headers-checker-state` in your Apify account). The next run with the same `stateName` delivers a domain again only when its certificate was renewed or replaced, its grade changed, or its certificate entered the warning window or expired. A domain whose `daysLeft` merely went down by a day is skipped and not charged. The first run delivers every domain it can read. Use a different `stateName` for each list so they keep separate memories.

**Expiry monitoring on a schedule.** Create a schedule in Apify Console (daily is typical) with `onlyNew` on and the lead time you need in `expiryWarningDays`. The day a certificate comes within the window, its row is delivered again with `expiresSoon = true` and an issue line, and the webhook fires; after the certificate is renewed the next run delivers it once more with the new fingerprint. In between, the runs cost nothing but the start event.

**Notification when the run ends.** Put a webhook address in `notifyUrl` and the actor sends one JSON POST with the number of delivered rows, links to the dataset (JSON and CSV) and the run. It works with Slack and Discord incoming webhooks (the message is in `text` and `content`), with Make, n8n and Zapier catch hooks, and with your own endpoint. By default it is sent only when at least one row was delivered; `notifyWhenEmpty` sends it every time. The `RUN_SUMMARY` record lists the certificates that expired or expire soon with their days left, which is what an alert rule needs.

**Integrations.** Send the results to Make, n8n, Zapier, Google Sheets, Slack, Google Drive, Airtable or any webhook from the Integrations tab of the Actor, with no code.

**API, SDKs and AI agents.** Every run is available through the Apify API and the official JavaScript and Python clients; the Actor can also be called by AI agents through the Apify MCP server. The example input in the API tab is a working call.

### Use cases

- **Certificate expiry watch:** a daily schedule over the domains of a company or of a client portfolio, with a message when a certificate comes within 30 days of its end. Outages caused by a forgotten renewal are the most common and the most avoidable TLS failure.
- **Agency audits and sales prospecting:** run a prospect list through the actor and open the conversation with facts: no HSTS, no Content-Security-Policy, a certificate that ends next month, `http://` that is still served in clear text.
- **Security posture of a supplier list:** a quick outside-in look at the websites of vendors and partners, graded the same way, to decide who to ask questions first. It reads what a visitor's browser reads and does not test anything else.
- **Baseline and regression checks after a release:** run it before and after a change of CDN, proxy or hosting and compare the grades; with **Only new rows** the second run lists only what moved.
- **Migration checklists:** after moving a site to a new platform, check the certificate chain, the redirect from `http://` and the headers that the new platform stopped sending.
- **Store and brand sites:** audit the headers of a group of online shops, where Content-Security-Policy and Referrer-Policy are most often missing.

Ready-made examples, each with the input filled in (open one and press Start, or save it as your own task):

- [Watch SSL certificate expiry for a list of domains](https://apify.com/rowcraft/ssl-security-headers-checker/examples/certificate-expiry-watch-for-a-domain-list)
- [Grade the security headers of online store websites](https://apify.com/rowcraft/ssl-security-headers-checker/examples/security-headers-grade-of-online-stores)

### What this actor does not do

- Scan for vulnerabilities: no probing, no exploit tests, no port scan, no login, no form submission. It reads the certificate every browser receives and the headers every visitor receives.
- List every protocol and cipher a server accepts: it reports the TLS protocol and cipher that a modern client negotiates. A server that also still allows TLS 1.0 next to TLS 1.3 shows TLS 1.3.
- Check certificate revocation, Certificate Transparency logs, DNS CAA or DANE records, or the certificates of subdomains it was not asked about.
- Read the body of a page: the connection is closed after the headers. Security headers sent only on other pages, or set by a `<meta>` tag, are not seen.
- Collect contacts: no e-mail addresses, phone numbers or names of people. Certificate subject fields other than the common name are never copied.
- Use proxies, solve CAPTCHAs or get around an anti-bot page: a domain that answers with one keeps its certificate row and is reported in the coverage record.

### Limits and fair use

- **A pause between requests to the same host** (1,000 ms by default, minimum 250 ms). A domain takes about five requests: the TLS handshake, robots.txt and the home page over `https://`, then robots.txt and the page over `http://`, plus any redirects. Up to four domains are checked at the same time, and different domains do not wait for each other. In our test runs that came to under two seconds per domain, roughly 2,000 domains an hour on a list of different sites.
- **robots.txt is obeyed** for every address whose page is requested, including redirect targets and the `http://` check. If robots.txt disallows the home page, the row carries the certificate only and `headersNote` says so. If robots.txt answers with a server error the page is not read, as the robots.txt standard (RFC 9309) requires. The TLS handshake is not an HTTP request and robots.txt does not apply to it; it is the same connection a browser opens.
- **Anti-bot pages** (Cloudflare, DataDome, Akamai and similar) are reported, never retried and never bypassed. The row still delivers the certificate. After 10 domains in a row answer with an anti-bot page, the actor stops reading headers for the rest of the list, because they would most likely be blocked too; certificates are still checked.
- **Redirects:** up to five are followed by hand for the home page; the headers are those of the page that finally answers. The `http://` check follows up to four.
- **The `http://` check is made only for port 443**, where the plain-HTTP counterpart is port 80. For a certificate on another port it is skipped and `httpToHttpsRedirect` is empty.
- **Up to 100,000 domains per run.** The run stops 90 seconds before its timeout with the summary, the coverage and the **Only new rows** memory saved; for long lists raise the timeout or split the list.
- **Header values** are cut at 300 characters in the row. Headers up to 128 KB are read.

### Data source and licence

The data is what each server sends to every visitor: the certificate chain in the TLS handshake and the response headers of its home page. The actor opens one TLS connection to read the handshake, then reads robots.txt and the home page of the site over `https://` and over `http://`, and keeps only the certificate fields and the header values listed in the output table. It does not store page content, cookies or any response body.

The grade is Rowcraft's own calculation from the recommendations of the OWASP Secure Headers Project and MDN, written out in full above. No third-party scoring service is queried or copied. The actor is independent and not affiliated with or endorsed by OWASP, MDN, any certificate authority or any of the websites it reads; product and organisation names belong to their owners and are used only to say what a header or an issuer is.

### Privacy: no personal data

Rowcraft actors are built not to collect personal data:

- From the certificate subject only the **common name** is delivered, and only when it is a domain name or an IP address. The organisation, organisational unit, e-mail address, locality, country and any other subject field are never copied, because on some certificates they name a person.
- The issuer fields (organisation and name of the certificate authority) are delivered, except on a self-signed certificate, where the issuer is the subject itself and is left empty.
- The certificate's names list keeps only DNS names and IP addresses; e-mail addresses and URIs in it are ignored.
- Header values are cut at 300 characters, and an e-mail address or a phone number inside one is removed.
- Only the home page of each host is requested. No cookies are sent or stored, no form is filled and nothing is logged into.

You are responsible for using the data in line with the law that applies to you.

### Other Rowcraft actors

All Rowcraft actors read official or public sources, deliver flat rows without personal data and support only-new runs and notifications:

- [Ashby Jobs Scraper – Job Postings with Salary Ranges](https://apify.com/rowcraft/ashby-jobs-scraper) — Job postings from Ashby job boards (jobs.ashbyhq.com) by company: title, department, team, locations with country, employment and workplace type, published salary range, full text.
- [Broken Link Checker – Find 404s and Dead Links API](https://apify.com/rowcraft/broken-link-checker) — Pay per crawled page, not per link: crawl a site within robots.txt and check every link on each page for 404s, 5xx errors, DNS and TLS failures and redirects.
- [Career Site Jobs Scraper: Greenhouse, Lever, Ashby, Workday](https://apify.com/rowcraft/career-site-jobs-scraper) — Job listings from the career pages of the companies you choose on Greenhouse, Lever, Ashby, Workday, Workable, Personio, Recruitee, Teamtailor and Gem, in one run and one format: title, locations, department, salary when published, full text.
- [Chrome Web Store Scraper: Users, Ratings & Versions](https://apify.com/rowcraft/chrome-web-store-scraper) — Reads public Chrome Web Store listing pages with no login, no proxy and no personal data: users, rating, category, version, update date, permissions and company developers.
- [Domain Email and DNS Checker API: MX, SPF, DMARC, Providers](https://apify.com/rowcraft/domain-email-dns-checker) — Find which email provider, sending services and DNS host each domain uses, from public DNS records only.
- [SIRENE France Company Scraper: SIREN, NAF, Revenue, Status](https://apify.com/rowcraft/france-company-register) — French companies from the official Recherche d'entreprises API (INSEE SIRENE + INPI): SIREN and SIRET, legal form, NAF activity, head-office address, employee band, revenue and net income, labels, creation date and VAT number.
- [Gem Jobs Scraper – Job Board Listings from jobs.gem.com](https://apify.com/rowcraft/gem-jobs-scraper) — Job listings from Gem job boards (jobs.gem.com) by company: title, department, offices with country, employment type, remote, hybrid or on-site, requisition ID, publication date and full ad text, from the public Gem Job Board API.
- [Google Play Apps Scraper: App Details, Installs, Ratings](https://apify.com/rowcraft/google-play-apps-scraper) — Public Google Play app details as flat rows: installs, rating, number of ratings, price, version, last update, minimum Android, ads and in-app purchases.
- [Greenhouse Jobs Scraper – Job Listings by Company Board](https://apify.com/rowcraft/greenhouse-jobs-scraper) — Job listings from Greenhouse job boards by company: title, departments, offices, publication date, full ad text, published pay ranges.
- [Himalayas Jobs Scraper: Remote Jobs API with Salaries](https://apify.com/rowcraft/himalayas-jobs-scraper) — Remote jobs from Himalayas through its public jobs API: title, company, salary range, seniority, categories, the countries and time zones open to candidates, full description and job link.
- [KRS Poland Companies Scraper: Register Data, PKD, Status](https://apify.com/rowcraft/krs-poland-companies) — Polish companies from the official KRS register API of the Ministry of Justice: name, KRS, NIP and REGON numbers, legal form, status, address, PKD activity codes, share capital, branches and registration dates.
- [LEI Records Scraper: Legal Entity Identifier Lookup API](https://apify.com/rowcraft/lei-records-scraper) — Legal Entity Identifier (LEI) records from the Global LEI Index, read through the public GLEIF API: legal name, legal form, register number, addresses, status, renewal date and parent companies.
- [Lever Jobs Scraper – Job Postings from jobs.lever.co](https://apify.com/rowcraft/lever-jobs-scraper) — Job postings from Lever career pages (jobs.lever.co) by company: title, team, department, location, commitment, workplace type, salary range when published, description, requirements and benefits.
- [Norway Company Register Scraper: Brønnøysund Business Data](https://apify.com/rowcraft/norway-company-register-scraper) — Norwegian companies from the Central Coordinating Register for Legal Entities (Brønnøysund, NLOD open data): organisation number, legal form, industry, employees, share capital, addresses, website, VAT and bankruptcy status.
- [Personio Jobs Scraper: Job Listings, Salaries, Departments](https://apify.com/rowcraft/personio-jobs-scraper) — Job ads from any company's Personio careers feed: title, department, office, employment type, schedule, seniority, salary when published, keywords and the full description in the language you choose.
- [Platsbanken Scraper: Sweden Jobs, Employers, Org Numbers](https://apify.com/rowcraft/platsbanken-jobs-scraper) — Every job ad on Platsbanken (Arbetsförmedlingen) from the official JobTech API: headline, employer and organisation number, occupation codes, municipality, coordinates, salary type, deadline and full text.
- [Recruitee Jobs Scraper – Job Listings by Company Career Site](https://apify.com/rowcraft/recruitee-jobs-scraper) — Job listings from Recruitee career sites by company: title, department, locations with country, employment type, remote flag, published salary and full text, one request per company.
- [Robots.txt and AI Crawler Access Checker API](https://apify.com/rowcraft/robots-ai-crawler-checker) — Check which AI and search crawlers a website lets in: GPTBot, ClaudeBot, PerplexityBot, Google-Extended and more, read from robots.txt by the RFC 9309 rules.
- [RSS Feed Finder and Reader – Blog and News Article API](https://apify.com/rowcraft/rss-feed-finder-reader) — Find the RSS, Atom and JSON feeds of any website and read their newest articles, from a domain name alone.
- [SEO Audit Tool: Titles, Meta Tags, Headings and Links API](https://apify.com/rowcraft/seo-audit-tool) — Audit the on-page SEO of any list of pages or websites: titles, meta descriptions, headings, canonicals, indexing, links, images and structured data, with a score and the issues found per page.
- [Shopify Products Scraper: Store Catalog Export to JSON, CSV](https://apify.com/rowcraft/shopify-products-scraper) — Products from any Shopify store's public catalog: title, vendor, type, tags, description, variants with price, compare-at price, SKU and stock, images, options, store currency.
- [Sitemap URL Extractor: Every Page with Last-Modified Dates](https://apify.com/rowcraft/sitemap-url-extractor) — Get every page a site lists in its sitemaps, with last-modified dates, from robots.txt through sitemap indexes and .gz files.
- [Store Products Scraper – Shopify, WooCommerce, VTEX](https://apify.com/rowcraft/store-products-scraper) — Export the product catalogue of any Shopify, WooCommerce or VTEX store from its public catalogue endpoint: title, brand, prices, discounts, stock, categories, images and links, one row per product, the same columns on every platform.
- [Structured Data Extractor: JSON-LD, Schema.org, Open Graph](https://apify.com/rowcraft/structured-data-extractor) — Pull the schema.org JSON-LD, Microdata, RDFa and Open Graph of any page list into flat rows: types, product price, availability, ratings, organization, breadcrumbs, with validation issues.
- [Teamtailor Jobs Scraper – Career Site Jobs by Company](https://apify.com/rowcraft/teamtailor-jobs-scraper) — Job listings from Teamtailor career sites by company: title, department, role, locations with city and country, remote or hybrid status, publication date and full ad text, from the official job feed.
- [TED Tenders Scraper: EU Public Procurement Notices API](https://apify.com/rowcraft/ted-tenders-scraper) — EU public procurement notices from TED (Tenders Electronic Daily), the official EU tenders portal, through its public Search API: title, buyer, country, CPV codes, values, deadlines, lots and document links.
- [UK Companies House Scraper: Company Search & Profiles API](https://apify.com/rowcraft/uk-companies-house-scraper) — UK companies from the official Companies House API with your free key: search by name, status, type, SIC code, date or location, or look up company numbers.
- [UK Tenders Scraper: Find a Tender + Contracts Finder API](https://apify.com/rowcraft/uk-tenders-scraper) — UK public procurement notices from Find a Tender and Contracts Finder, the official UK government portals, through their open OCDS APIs: title, buyer, region, CPV codes, values, deadlines, notice type and links.
- [Bulk URL Status and Redirect Chain Checker API](https://apify.com/rowcraft/url-status-redirect-checker) — Check the status code, redirect chain, canonical and indexing signals of every URL in a list, with the final destination and a loop flag.
- [VTEX Products Scraper – Public Catalog Export](https://apify.com/rowcraft/vtex-products-scraper) — Export the catalogue of any VTEX store (Auchan, Chedraui and thousands of retailers in Europe and Latin America) from its public search endpoint: title, brand, EAN, prices, list prices, stock, categories, specifications and images, one row per product.
- [Website Tech Stack Detector – Technology Lookup API](https://apify.com/rowcraft/website-tech-stack-detector) — Find the technologies behind a list of websites: CMS, e-commerce platform, analytics, tag managers, ad pixels, consent tools, chat, CDN and payments, from one polite home-page request per domain.
- [WooCommerce Products Scraper – Store API Export](https://apify.com/rowcraft/woocommerce-products-scraper) — Export every product of a WooCommerce store through its public Store API: title, SKU, prices and sale prices, stock, categories, tags, attributes, ratings, images and links, one row per product.
- [Workable Jobs Scraper: Job Listings from Career Pages](https://apify.com/rowcraft/workable-jobs-scraper) — Job listings from any company's Workable career page: title, department, location, remote or on-site, employment type, description, requirements, benefits and salary when published.
- [Workday Jobs Scraper – Jobs from myworkdayjobs.com Sites](https://apify.com/rowcraft/workday-jobs-scraper) — Job listings from Workday career sites (myworkdayjobs.com) by company: title, locations, country, posting date, time type, requisition ID and the full description.

### FAQ

**What exactly does the grade measure?** The security headers of the home page, the redirect from `http://` to `https://` and the state of the certificate, combined by the formula in the "How the grade is calculated" section. It does not measure how secure the application behind the site is.

**Why is a site with a valid certificate graded F?** Either its headers are almost all missing (a site with no security headers at all, such as a plain landing page, scores near the bottom), or the certificate has a problem that caps the grade: the `issues` column of the row names it. A grade is never lowered without a line that explains it.

**Why is the grade empty?** The row carries the certificate only. The `headersNote` column says why: robots.txt disallows the home page, an anti-bot page answered, the page returned an error, or you turned **Also check the security headers** off. The certificate columns are complete in that case.

**Which certificate is read when a domain has several?** The one the server presents to a client that asks for exactly the host name you wrote, with the name in the TLS handshake, as a browser would. That is why `www.example.com` and `example.com` are checked separately.

**Why does `chainTrusted` say false for a certificate that works in my browser?** A browser can repair a chain that the server sends incompletely, by fetching the missing intermediate certificate itself. The actor does not: `chainError` shows `UNABLE_TO_VERIFY_LEAF_SIGNATURE` and the issue line says the intermediate is missing. Clients that do not repair chains (many APIs, mobile apps, command-line tools) fail on such a server, so it is worth fixing.

**Which roots does it trust?** The root certificates that ship with the Node.js runtime of the actor, which follow the Mozilla list, so a certificate from a private or corporate authority shows `chainTrusted = false`.

**Is it legal?** The actor reads the certificate that every browser receives and the headers of one public page per site, obeys robots.txt for the page requests and never probes, logs in or submits anything. It is not a vulnerability scanner. Whether and how you may use the results, for example for sales outreach, depends on the law that applies to you; check only domains you own or that you are allowed to look at.

**Does it collect personal data?** No personal data: no e-mail addresses, phone numbers or names of people, and no certificate subject field except the common name when it is a domain. See the Privacy section.

**Why is the result empty?** Every domain in the list could not be checked, or was skipped. The `COVERAGE` record gives the reason per domain: no TLS service on the port (`no_tls`), no such domain (`not_found`), an invalid entry (`error`). With **Only new rows** on, domains whose certificate and grade did not change are skipped too. Nothing is charged for those, apart from the start event.

**Do I pay for domains that have no certificate or do not exist?** No. Only domains whose certificate was read are charged, and a duplicate in your list is read once.

**Can I check a certificate on a port other than 443?** Yes: write `example.com:8443` or set **Port of the TLS service** for the whole list. The redirect check from `http://` is made only for port 443.

**Can I check an IP address?** Yes, an IPv4 or IPv6 address works as an entry; the certificate is then matched against the IP addresses it lists. Private and local addresses are refused on the Apify platform.

**What does `ocspStapling` mean?** `true` means the server sent a signed OCSP answer with the handshake, which lets browsers check revocation without contacting the authority; `false` means it did not. It is information, not a deduction.

**How does Only new rows work here?** The actor remembers, per domain, the certificate fingerprint, the grade and whether the certificate expired or is about to. A later run with the same state name delivers a domain again only when one of those changed, so a daily schedule costs only the domains that need your attention.

### Support and reviews

**Problems, missing fields, questions:** open an issue on the **Issues** tab of this Actor. We answer within one working day and fix confirmed bugs in the next release; the changelog lists every change.

If this Actor saved you time, a short review on its page helps other users find it and helps us keep improving it.

# Changelog

This Actor's version history is a separate document: https://apify.com/rowcraft/ssl-security-headers-checker/changelog.md

# Actor input Schema

## `domains` (type: `array`):

Websites to check, one per line: a domain (example.com), an address (https://www.example.com/shop) or a domain with a port (example.com:8443). The host is checked exactly as written (www.example.com and example.com can have different certificates). Duplicates and invalid entries are skipped and never charged.

## `checkHeaders` (type: `boolean`):

Besides the certificate, read the home page (after robots.txt) for HSTS, Content-Security-Policy, X-Frame-Options and the other security headers, check the redirect from http:// to https://, and give the A+ to F grade. Turn it off for a certificate-only check that sends no HTTP request.

## `expiryWarningDays` (type: `integer`):

Certificates with this many days left or fewer get expiresSoon = true and an issue line. Certificates that already expired get expired = true.

## `maxItems` (type: `integer`):

Stop after this many rows are delivered. 0 = the whole list.

## `port` (type: `integer`):

The port where the certificate is read, 443 for websites. A port written in an entry (example.com:8443) wins over this value. The http:// to https:// check is made only for port 443.

## `onlyNew` (type: `boolean`):

Remember the rows already delivered to you (in a key-value store in your Apify account) and deliver only rows that appeared since the last run with the same state key. The first run delivers everything that matches; later runs cost only the new rows. Ideal for schedules.

## `stateName` (type: `string`):

Name of the memory used by "Only new rows". Use a different name for each schedule or search (for example `stockholm-python`) so they do not share one memory.

## `notifyUrl` (type: `string`):

A webhook address that receives one JSON POST with the number of new rows and links to the dataset: a Slack or Discord incoming webhook, a Make, n8n or Zapier catch hook, or your own endpoint. The message is also in the `text` (Slack) and `content` (Discord) fields.

## `notifyWhenEmpty` (type: `boolean`):

By default the notification is sent only when at least one row was delivered.

## `requestIntervalMs` (type: `integer`):

Minimum pause between two requests to the same host, default 1000 ms. A domain takes about five: the handshake, robots.txt, the home page, robots.txt for http:// and the http:// page. Different domains are checked in parallel. Minimum 250.

## Actor input object example

```json
{
  "domains": [
    "github.com",
    "wikipedia.org",
    "example.com"
  ],
  "checkHeaders": true,
  "expiryWarningDays": 30,
  "maxItems": 0,
  "port": 443,
  "onlyNew": false,
  "stateName": "default",
  "notifyWhenEmpty": false,
  "requestIntervalMs": 1000
}
```

# Actor output Schema

## `results` (type: `string`):

One row per domain with its certificate, security headers, grade and issues, in the default dataset (JSON, CSV, Excel and other formats via the dataset API).

## `certificates` (type: `string`):

Expiry view of the same rows: valid until, days left, expired and expiring soon first.

## `runSummary` (type: `string`):

Counts, grades, the certificates that expire soon, warnings and why the run stopped (RUN_SUMMARY record in the default key-value store).

## `coverage` (type: `string`):

One line per domain you asked for: ok, tls_only, no_tls, not_found, error or not_checked, with the reason (COVERAGE record).

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "domains": [
        "github.com",
        "wikipedia.org",
        "example.com"
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("rowcraft/ssl-security-headers-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "domains": [
        "github.com",
        "wikipedia.org",
        "example.com",
    ] }

# Run the Actor and wait for it to finish
run = client.actor("rowcraft/ssl-security-headers-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "domains": [
    "github.com",
    "wikipedia.org",
    "example.com"
  ]
}' |
apify call rowcraft/ssl-security-headers-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,rowcraft/ssl-security-headers-checker"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/P8FUidQzg1BPJZYJ4/builds/FXPSr7GnHkkQdFfkc/openapi.json