Security Headers Auditor | HTTP Policy Inventory

Security Headers Auditor | HTTP Policy Inventory

Inspect public HTTP response headers for CSP, HSTS, framing controls, content-type protection, referrer and permissions policies, and cross-origin isolation. Return raw policy values and concrete review observations for recurring website checks.

How it works

The Actor sends a public GET request, inspects response headers and discards the body. It follows up to four HTTP redirects and returns CSP, report-only CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and cross-origin policy headers. Review observations include missing selected headers, HSTS max-age zero, unexpected content-type protection values, and literal unsafe-inline or unsafe-eval tokens requiring contextual review. Set-Cookie, authentication headers and unrelated server headers are deliberately excluded from output.

Quick start

1. Enter one or more public URLs in the Input tab, beginning with the supplied example.
2. Set a maximum run charge. A completed check costs $0.005; checking 10 sources once costs $0.05.
3. Start the Actor and inspect the dataset. Download JSON, CSV or Excel, or consume results through the Apify API.
4. Inspect the OUTPUT run summary as well as the dataset: failed or unprocessed inputs appear there. Save the input as a task if you want to schedule future runs.

Pricing

$0.005 per completed check ($5 per 1,000), with platform usage included. There are no separate Actor-start or dataset-item fees. Empty and unchanged successful checks are charged. The maximum charge is checked before each source request and again before output. Failed network or format checks are free; see the specific HTTP-response cases below. Billing is per completed source check, not per nested array item, extracted URL, change or schema block.

Limits and interpretation

This is a passive response-policy inventory, not a penetration test, vulnerability certification, CSP parser or universal security score. Header presence does not prove a policy is effective. Some CSP tokens are safe in context, and framing controls can differ by resource. HTTP 403, 429, 404 and 5xx responses are completed charged observations marked error_response; they may describe an edge or error page rather than application pages. Network, TLS, timeout and prohibited-target failures are free. Bodies, page links and subresources are not downloaded.

A run accepts 1-50 unique input URLs and requests them sequentially. Each check has an 18-second network deadline; new checks stop after 160 seconds. Use a 240-second run timeout and 512 MB memory. If the time or charge limit stops a batch, OUTPUT lists uncheckedUrls for a later run. No response exceeding the configured byte limit is accepted, and a complete record must fit within 6 MB. The Actor permits only public HTTP(S) destinations on standard ports, pins a validated DNS address per request, and refuses redirects into private networks or from HTTPS to HTTP.

The Actor uses direct HTTP requests, without a browser, residential proxy, login, CAPTCHA solving or access-control bypass. Rate limits and blocks may prevent checks. Avoid secret-bearing URLs. Results describe the source and network observed at check time.

Integrations and support

Connect the dataset and OUTPUT summary to your own n8n, Make, Zapier or API workflow. This Actor produces data; it does not automatically send email, Slack messages or webhooks to third parties. No external account credentials are needed for the supplied public examples. Report reproducible issues in the Actor Issues tab, including a non-sensitive input and run link. This is an independent utility and is not endorsed by the websites, standards bodies or services it reads.

Input example

{
  "urls": [
    "https://example.com/"
  ]
}

See the Input tab for all supported fields. Results are available through the dataset API and can be downloaded as JSON, CSV or Excel.

Output fields

Field	Meaning
inputUrl	Normalized supplied URL.
checkedAt	Check time in ISO format.
finalUrl	Final URL after HTTP redirects.
httpStatus	Observed final response status.
responseContext	error_response for HTTP >=400; otherwise page_response.
headers	Allowlisted policy headers; absent headers are null.
observations	Concrete header presence or value observations, not exploit findings.

Output example

Example from a public source check; live values vary. Long items, changes, groups and blocks arrays are shortened to two entries here for readability; the actual record contains the complete arrays within the documented limits.

{
  "inputUrl": "https://example.com/",
  "checkedAt": "2026-09-07T21:05:12.829Z",
  "finalUrl": "https://example.com/",
  "httpStatus": 200,
  "responseContext": "page_response",
  "headers": {
    "strict-transport-security": null,
    "content-security-policy": null,
    "content-security-policy-report-only": null,
    "x-content-type-options": null,
    "x-frame-options": null,
    "referrer-policy": null,
    "permissions-policy": null,
    "cross-origin-opener-policy": null,
    "cross-origin-resource-policy": null,
    "cross-origin-embedder-policy": null
  },
  "observations": [
    "missing_content-security-policy",
    "missing_x-content-type-options",
    "missing_referrer-policy",
    "missing_strict-transport-security",
    "no_observed_frame_restriction"
  ]
}