# Changelog of SSL Certificate and Security Headers Checker API (`rowcraft/ssl-security-headers-checker`) Actor

- **URL**: https://apify.com/rowcraft/ssl-security-headers-checker/changelog.md
- **Full Actor documentation**: https://apify.com/rowcraft/ssl-security-headers-checker.md

## Changelog

### 1.0.3 (2026-10-17)

- Fix: a robots.txt served as an HTML page (catch-all page or a redirect to the home page, for example thumb.wikimedia.org) counted as an anti-bot block, so every page on that host was refused; it is now treated as a missing robots.txt, as the standard says. Real anti-bot pages are still recognised.

### 1.0.2 (2026-10-17)

- Shared library: URL-like fields named link or guid (feed items) are no longer flagged as phone numbers; retry log line now reads "retry n/m".
- Shared library: an HTML page where JSON was expected (maintenance or block page, seen on 17.10.2026 at the Polish KRS API and at Workday) is retried and then reported with the page text instead of crashing the run on a parse error.

### 1.0.1 (2026-10-15)

- README: real screenshots of the input form and of the results (Console).
- Icon uploaded in Console; two example tasks run on the platform.

### 1.0.0 (2026-10-15)

- First release: the TLS certificate and the HTTP security headers of every domain in a list, one row per domain with a grade from A+ to F. The certificate is read with one TLS handshake (no HTTP request); the headers come from the home page after the robots.txt of the host was read and obeyed.
- One row per domain: grade, score, the issues that explain the grade, the TLS protocol and cipher, the certificate (common name when it is a domain, issuer, valid from and to, days left, `expired`, `expiresSoon`, `selfSigned`, trust of the chain with the reason, host name match, names, key type and size, signature algorithm, OCSP stapling, SHA-256 fingerprint), the value of each security header (HSTS with max-age, includeSubDomains and preload, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP, COEP, CORP, Server, X-Powered-By), whether `http://` redirects to `https://`, and the list of missing headers.
- The grading formula is published in the README (weights taken from the OWASP Secure Headers Project and MDN recommendations); certificate problems (expired, self-signed, untrusted chain, host name mismatch, old protocol, weak key or signature) cap the grade.
- Only the common name of the certificate subject is delivered, and only when it is a domain or an IP address; organisation, unit, e-mail and the other subject fields are never copied.
- `COVERAGE` lists every domain that was not delivered (no TLS service, not found, error, not checked) and the rows delivered with the certificate only (`tls_only`: robots.txt disallows the home page, an anti-bot page answered, or an error). Domains without TLS, domains that do not exist, invalid and repeated entries and domains skipped by `onlyNew` are never charged.
- Standard Rowcraft automation: `onlyNew` and `stateName` (a domain is delivered again only when its certificate, its grade or its expiry state changed), end-of-run notification (`notifyUrl`, `notifyWhenEmpty`), charge cap respected, `maxItems`, stop with the summary saved 90 seconds before the run timeout, `RUN_SUMMARY` with the grade counts and the certificates that expire soon, one request per host and second by default (minimum 250 ms), four domains at a time, rows in the order of the list.