Website Security Headers Scanner (Grade, HSTS, CSP, Cookies)

Scan any website and get a clear, transparent security grade for its HTTP response headers, cookie flags, HTTPS enforcement and TLS certificate. Point it at a list of URLs or bare domains and it returns one graded record per site: a letter grade (A+ to F), a 0 to 100 score, per-header pass/fail, parsed HSTS and CSP, cookie security flags, the redirect chain, and optional certificate details plus an AI remediation plan.

Here is one real result (Content-Security-Policy value trimmed for readability), with every field the actor returns:

{
  "url": "https://github.com/",
  "finalUrl": "https://github.com/",
  "statusCode": 200,
  "redirectChain": [],
  "httpsEnforced": true,
  "grade": "C",
  "score": 73,
  "securityHeaders": {
    "strictTransportSecurity": {
      "raw": "max-age=31536000; includeSubdomains; preload",
      "maxAge": 31536000,
      "includeSubDomains": true,
      "preload": true
    },
    "contentSecurityPolicy": {
      "present": true,
      "weaknesses": ["unsafe-inline"],
      "weak": true,
      "raw": "default-src 'none'; base-uri 'self'; ... frame-ancestors 'none'; ..."
    },
    "xFrameOptions": "deny",
    "xContentTypeOptions": "nosniff",
    "referrerPolicy": "origin-when-cross-origin, strict-origin-when-cross-origin",
    "permissionsPolicy": null,
    "crossOriginOpenerPolicy": null,
    "crossOriginEmbedderPolicy": null,
    "crossOriginResourcePolicy": null
  },
  "infoLeakHeaders": { "server": "github.com" },
  "server": "github.com",
  "cookies": [
    { "name": "_gh_sess", "secure": true, "httpOnly": true, "sameSite": "Lax" },
    { "name": "_octo", "secure": true, "httpOnly": false, "sameSite": "Lax" },
    { "name": "logged_in", "secure": true, "httpOnly": true, "sameSite": "Lax" }
  ],
  "cookieFlagsOk": false,
  "insecureCookies": [
    { "name": "_octo", "problems": ["missing HttpOnly"], "secure": true, "httpOnly": false, "sameSite": "Lax" }
  ],
  "missingHeaders": ["permissions-policy", "cross-origin-opener-policy", "cross-origin-resource-policy"],
  "weakHeaders": ["content-security-policy (unsafe-inline)"],
  "tlsCertificate": {
    "subject": "github.com",
    "issuer": "Sectigo Public Server Authentication CA DV E36",
    "issuerOrg": "Sectigo Limited",
    "validFrom": "2026-07-03T00:00:00.000Z",
    "validTo": "2026-09-30T23:59:59.000Z",
    "daysUntilExpiry": 45,
    "isExpired": false,
    "san": ["github.com", "www.github.com"],
    "sanCount": 2,
    "keyType": "EC",
    "keyBits": 256,
    "serialNumber": "72010E03F4A067FE4E796266430718F6",
    "hostnameMatches": true
  },
  "aiRiskLevel": "medium",
  "aiRiskSummary": "The website has a moderate security posture with a grade of C, indicating several areas for improvement. Key missing headers and weak configurations could expose the site to potential vulnerabilities, particularly regarding cross-origin policies and cookie security.",
  "aiTopFixes": [
    "Implement missing headers: permissions-policy, cross-origin-opener-policy, and cross-origin-resource-policy.",
    "Strengthen the Content Security Policy by removing 'unsafe-inline' to mitigate XSS risks.",
    "Set the HttpOnly flag for the '_octo' cookie to prevent access via JavaScript."
  ],
  "observedAt": "2026-08-16T19:27:16.206Z",
  "error": null
}

What you get

• A letter grade (A+ to F) and a 0 to 100 score for every site, from a fully documented rubric (below). No black-box number.
• Per-header analysis of the headers that matter: Strict-Transport-Security (with parsed max-age, includeSubDomains, preload), Content-Security-Policy (present plus weakness flags such as unsafe-inline, unsafe-eval and wildcard sources), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and the Cross-Origin-Opener / Embedder / Resource policies.
• HTTPS enforcement and the full redirect chain, so you can see whether http:// is upgraded to https:// and where each hop leads.
• Cookie security flags for every Set-Cookie: Secure, HttpOnly and SameSite, with a list of insecure cookies and exactly what each one is missing.
• Information-leak headers flagged (Server, X-Powered-By, X-AspNet-Version) so you know what a site is telling attackers about its stack.
• missingHeaders and weakHeaders arrays that read like a ready-made to-do list.
• Optional TLS certificate details (issuer, validity window, days until expiry, SAN list, key type and size, hostname match) for certificate-expiry monitoring.
• Optional AI security posture assessment with a plain-English summary and the top 3 prioritized fixes.

Input

Field	Type	Description
urls	array	One or more websites to scan. Accepts a full URL (https://example.com/path) or a bare domain (example.com, scanned over HTTPS).
url	string	Alternative to urls: a single site, or several separated by commas, spaces or new lines.
includeTlsCertificate	boolean	Paid add-on (default off). Return the leaf TLS certificate for each host. Billed only when a certificate is retrieved.
withAiRisk	boolean	Paid AI add-on (default off). Return an AI security posture assessment and the top 3 fixes. Billed only on usable output.
maxUrls	integer	Maximum number of URLs to process. Free Apify accounts are capped at 10 URLs per run.
proxyConfiguration	object	Optional proxy settings. Scanning works without a proxy.

Output

Field	Description
url / finalUrl	The requested URL and the final URL after following redirects.
statusCode	HTTP status code of the final response.
redirectChain	Ordered list of {from, to, status} redirects followed.
httpsEnforced	Whether the site enforces HTTPS (http upgraded to, or request stayed on, https).
grade / score	Letter grade (A+ to F) and numeric score (0 to 100).
securityHeaders	Parsed security headers, including structured HSTS and CSP.
infoLeakHeaders / server	Information-leak headers disclosed by the site.
cookies / cookieFlagsOk / insecureCookies	Cookie flags, an all-cookies-safe boolean, and the list of unsafe cookies.
missingHeaders / weakHeaders	Recommended headers that are absent, and headers present but misconfigured.
tlsCertificate	TLS add-on: subject, issuer, validity, days until expiry, SAN, key type/size, hostname match.
aiRiskLevel / aiRiskSummary / aiTopFixes	AI add-on: risk level, plain-English assessment and top 3 fixes.
observedAt	When the scan was performed.
error	Error message if the site could not be scanned (this row is never billed).

Scoring rubric (transparent)

Every site starts at 100 points. Deductions are applied as follows, then the score maps to a letter grade. This is the exact weighting used in the actor, so you can reproduce and defend any grade.

Control	Missing	Weak / misconfigured
Content-Security-Policy	-25	-10 (unsafe-inline, unsafe-eval, wildcard source, no frame-ancestors)
Strict-Transport-Security (HSTS)	-20	-8 (max-age below 180 days)
X-Content-Type-Options	-10	-5 (not nosniff)
X-Frame-Options	-10 (unless CSP sets frame-ancestors)	-
Referrer-Policy	-8	-4 (unsafe-url)
Permissions-Policy	-7	-
Cross-Origin-Opener-Policy	-3	-
Cross-Origin-Resource-Policy	-2	-
HTTPS (site served over plain http)	-15	-10 (http not redirected to https)
Each information-leak header (Server, X-Powered-By, X-AspNet-Version)	-2	-
Insecure cookies (missing Secure / HttpOnly / SameSite)	up to -8	-

Grade bands: A+ 95 to 100, A 85 to 94, B 75 to 84, C 65 to 74, D 50 to 64, E 35 to 49, F below 35.

Use cases

• Security audits and posture monitoring across a portfolio of domains, on a schedule.
• PCI DSS, SOC 2 and ISO 27001 prep: evidence that HSTS, CSP, secure cookies and HTTPS redirects are in place.
• Penetration-test and bug-bounty recon: quickly surface missing headers, unsafe cookies and leaky Server banners across a scope.
• Vendor and third-party due-diligence: grade a supplier's public sites before you integrate or sign.
• TLS certificate-expiry monitoring: catch certificates that are about to lapse, with issuer and SAN detail.
• Marketing and lead-gen for security vendors: grade a prospect's site and lead with the top 3 fixes.
• Continuous compliance dashboards: feed the grade and missingHeaders into your own reporting.

Billing

This actor uses pay-per-event pricing:

• Result ($0.008) - one graded security record per scanned URL: grade, score, per-header analysis, cookie flags, HTTPS enforcement and redirect chain. Unreachable or challenged sites return an unbilled error row; you are never charged on failure.
• TLS certificate details ($0.008, opt-in via includeTlsCertificate) - charged once per URL, only when a certificate is actually retrieved.
• AI security posture assessment ($0.012, opt-in via withAiRisk) - charged once per URL, only when the model returns a usable assessment.

Paid add-ons are disabled for free Apify accounts, and free accounts are capped at 10 URLs per run.