Pricing

$4.99/month + usage

Security Headers Checker - Audit CSP, HSTS, XFO and more

Check common HTTP security headers for one or more URLs (Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP). Useful for quick security hardening audits.

Pricing

$4.99/month + usage

Rating

0.0

(0)

Developer

Bikram Adhikari

Actor stats

Bookmarked

Total users

Monthly active users

21 days ago

Last modified

Categories

Developer tools

You can access the Security Headers Checker - Audit CSP, HSTS, XFO and more programmatically from your own applications by using the Apify API. You can also choose the language preference from below. To use the Apify API, you’ll need an Apify account and your API token, found in Integrations settings in Apify Console.

Python

JavaScript

CLI

OpenAPI

HTTP

MCP

{
  "openapi": "3.0.1",
  "info": {
    "version": "1.0",
    "x-build-id": "4t1KGr7JoDaJigcl5"
  },
  "servers": [
    {
      "url": "https://api.apify.com/v2"
    }
  ],
  "paths": {
    "/acts/scrappy_garden~security-headers-checker/run-sync-get-dataset-items": {
      "post": {
        "operationId": "run-sync-get-dataset-items-scrappy_garden-security-headers-checker",
        "x-openai-isConsequential": false,
        "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.",
        "tags": [
          "Run Actor"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/inputSchema"
              }
            }
          }
        },
        "parameters": [
          {
            "name": "token",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Enter your Apify token here"
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          }
        }
      }
    },
    "/acts/scrappy_garden~security-headers-checker/runs": {
      "post": {
        "operationId": "runs-sync-scrappy_garden-security-headers-checker",
        "x-openai-isConsequential": false,
        "summary": "Executes an Actor and returns information about the initiated run in response.",
        "tags": [
          "Run Actor"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/inputSchema"
              }
            }
          }
        },
        "parameters": [
          {
            "name": "token",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Enter your Apify token here"
          }
        ],
        "responses": {
          "200": {
            "description": "OK",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/runsResponseSchema"
                }
              }
            }
          }
        }
      }
    },
    "/acts/scrappy_garden~security-headers-checker/run-sync": {
      "post": {
        "operationId": "run-sync-scrappy_garden-security-headers-checker",
        "x-openai-isConsequential": false,
        "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.",
        "tags": [
          "Run Actor"
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/inputSchema"
              }
            }
          }
        },
        "parameters": [
          {
            "name": "token",
            "in": "query",
            "required": true,
            "schema": {
              "type": "string"
            },
            "description": "Enter your Apify token here"
          }
        ],
        "responses": {
          "200": {
            "description": "OK"
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "inputSchema": {
        "type": "object",
        "required": [
          "startUrls"
        ],
        "properties": {
          "startUrls": {
            "title": "Start URLs",
            "type": "array",
            "description": "URLs to check for HTTP security headers.",
            "default": [
              {
                "url": "https://example.com"
              }
            ],
            "items": {
              "type": "object",
              "required": [
                "url"
              ],
              "properties": {
                "url": {
                  "type": "string",
                  "title": "URL of a web page",
                  "format": "uri"
                }
              }
            }
          },
          "maxUrls": {
            "title": "Max URLs",
            "minimum": 1,
            "maximum": 5000,
            "type": "integer",
            "description": "Maximum number of URLs to process.",
            "default": 50
          },
          "timeoutSecs": {
            "title": "Request timeout (seconds)",
            "minimum": 5,
            "maximum": 180,
            "type": "integer",
            "description": "Maximum time per URL request.",
            "default": 30
          },
          "useHeadRequest": {
            "title": "Use HEAD request first",
            "type": "boolean",
            "description": "If enabled, tries HEAD first and falls back to GET when needed.",
            "default": true
          },
          "followRedirects": {
            "title": "Follow redirects",
            "type": "boolean",
            "description": "If enabled, follows redirects to the final URL before evaluating headers.",
            "default": true
          },
          "maxRedirects": {
            "title": "Max redirects",
            "minimum": 0,
            "maximum": 50,
            "type": "integer",
            "description": "Maximum number of redirects to follow when followRedirects is enabled.",
            "default": 10
          },
          "userAgent": {
            "title": "User-Agent",
            "type": "string",
            "description": "Custom User-Agent string to send with requests.",
            "default": "ApifyActor Security Headers Checker (+https://apify.com)"
          },
          "checkCookies": {
            "title": "Check Set-Cookie flags (basic)",
            "type": "boolean",
            "description": "If enabled, performs basic checks for HttpOnly/Secure/SameSite on Set-Cookie headers.",
            "default": false
          },
          "checkServerHeader": {
            "title": "Warn on Server / X-Powered-By",
            "type": "boolean",
            "description": "If enabled, warns when Server or X-Powered-By headers are present (fingerprinting).",
            "default": false
          },
          "maxConcurrency": {
            "title": "Max concurrency",
            "minimum": 1,
            "maximum": 50,
            "type": "integer",
            "description": "Maximum number of URLs processed in parallel.",
            "default": 10
          },
          "proxyConfiguration": {
            "title": "Proxy Configuration",
            "type": "object",
            "description": "Proxy settings for accessing websites.",
            "default": {
              "useApifyProxy": false
            }
          }
        }
      },
      "runsResponseSchema": {
        "type": "object",
        "properties": {
          "data": {
            "type": "object",
            "properties": {
              "id": {
                "type": "string"
              },
              "actId": {
                "type": "string"
              },
              "userId": {
                "type": "string"
              },
              "startedAt": {
                "type": "string",
                "format": "date-time",
                "example": "2025-01-08T00:00:00.000Z"
              },
              "finishedAt": {
                "type": "string",
                "format": "date-time",
                "example": "2025-01-08T00:00:00.000Z"
              },
              "status": {
                "type": "string",
                "example": "READY"
              },
              "meta": {
                "type": "object",
                "properties": {
                  "origin": {
                    "type": "string",
                    "example": "API"
                  },
                  "userAgent": {
                    "type": "string"
                  }
                }
              },
              "stats": {
                "type": "object",
                "properties": {
                  "inputBodyLen": {
                    "type": "integer",
                    "example": 2000
                  },
                  "rebootCount": {
                    "type": "integer",
                    "example": 0
                  },
                  "restartCount": {
                    "type": "integer",
                    "example": 0
                  },
                  "resurrectCount": {
                    "type": "integer",
                    "example": 0
                  },
                  "computeUnits": {
                    "type": "integer",
                    "example": 0
                  }
                }
              },
              "options": {
                "type": "object",
                "properties": {
                  "build": {
                    "type": "string",
                    "example": "latest"
                  },
                  "timeoutSecs": {
                    "type": "integer",
                    "example": 300
                  },
                  "memoryMbytes": {
                    "type": "integer",
                    "example": 1024
                  },
                  "diskMbytes": {
                    "type": "integer",
                    "example": 2048
                  }
                }
              },
              "buildId": {
                "type": "string"
              },
              "defaultKeyValueStoreId": {
                "type": "string"
              },
              "defaultDatasetId": {
                "type": "string"
              },
              "defaultRequestQueueId": {
                "type": "string"
              },
              "buildNumber": {
                "type": "string",
                "example": "1.0.0"
              },
              "containerUrl": {
                "type": "string"
              },
              "usage": {
                "type": "object",
                "properties": {
                  "ACTOR_COMPUTE_UNITS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_WRITES": {
                    "type": "integer",
                    "example": 1
                  },
                  "KEY_VALUE_STORE_LISTS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_INTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_EXTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_SERPS": {
                    "type": "integer",
                    "example": 0
                  }
                }
              },
              "usageTotalUsd": {
                "type": "number",
                "example": 0.00005
              },
              "usageUsd": {
                "type": "object",
                "properties": {
                  "ACTOR_COMPUTE_UNITS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATASET_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "KEY_VALUE_STORE_WRITES": {
                    "type": "number",
                    "example": 0.00005
                  },
                  "KEY_VALUE_STORE_LISTS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_READS": {
                    "type": "integer",
                    "example": 0
                  },
                  "REQUEST_QUEUE_WRITES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_INTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "DATA_TRANSFER_EXTERNAL_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_RESIDENTIAL_TRANSFER_GBYTES": {
                    "type": "integer",
                    "example": 0
                  },
                  "PROXY_SERPS": {
                    "type": "integer",
                    "example": 0
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}

Security Headers Checker - Audit CSP, HSTS, XFO and more OpenAPI definition

OpenAPI is a standard for designing and describing RESTful APIs, allowing developers to define API structure, endpoints, and data formats in a machine-readable way. It simplifies API development, integration, and documentation.

OpenAPI is effective when used with AI agents and GPTs by standardizing how these systems interact with various APIs, for reliable integrations and efficient communication.

By defining machine-readable API specifications, OpenAPI allows AI models like GPTs to understand and use varied data sources, improving accuracy. This accelerates development, reduces errors, and provides context-aware responses, making OpenAPI a core component for AI applications.

You can download the OpenAPI definitions for Security Headers Checker - Audit CSP, HSTS, XFO and more from the options below:

OpenAPI.json

If you’d like to learn more about how OpenAPI powers GPTs, read our blog post.

You can also check out our other API clients:

Security Headers Checker - Audit CSP, HSTS, XFO and more API in Python

Security Headers Checker - Audit CSP, HSTS, XFO and more API in JavaScript

Security Headers Checker - Audit CSP, HSTS, XFO and more API through CLI

Security Headers Checker - Audit CSP, HSTS, XFO and more API

Security Headers Checker

pillowy_travel/security-headers-checker

Analyze HTTP security headers of websites and generate a security score. Detect missing headers like CSP, HSTS, X-Frame-Options, and more. Perfect for web security audits, vulnerability checks, learning, and automated monitoring.

SAHIL KUMAR

Website Security & Vulnerability Audit

smart-digital/website-security-vulnerability-audit

Automated security and vulnerability audit for websites. Detects WordPress plugin vulnerabilities, checks for updates, analyzes SSL/TLS, security headers, and CMS security

My Smart Digital

5.0

HSTS Header Checker - Strict-Transport-Security audit

scrappy_garden/hsts-header-checker

Fetches URLs and validates the Strict-Transport-Security (HSTS) response header. Parses directives (max-age/includeSubDomains/preload), flags missing/invalid configuration, and checks common best practices. Outputs per-URL results plus SUMMARY and REPORT.

Bikram Adhikari

Kali Security Tools Actor

syntellect_ai/kali-security-tools-actor

The **Kali Security Tools Actor** Run penetration testing, vulnerability assessments, and security research directly in the cloud - 🛡️ 600+ Security Tools - 🤖 AI Integration - ☁️ Cloud-Native - 📊 Structured Output - 🎯 Multiple Scan Modes - 📈 Comprehensive Reporting - 🔒 Built-in Safeguards**

christopher athans crow

Kali Security Tools Actor ppe

syntellect_ai/kali-security-tools-actorv2

christopher athans crow

Permissions-Policy Header Checker

scrappy_garden/permissions-policy-header-checker

Fetches URLs and analyzes the Permissions-Policy header (and legacy Feature-Policy). Flags missing headers, invalid syntax, and risky wildcard allowances for sensitive features like camera/microphone/geolocation. Outputs per-URL results plus SUMMARY and REPORT.

Bikram Adhikari

Check Http Header Security — Data, Details & Metadata

tropical_quince/http-header-security-checker

Check http header security data at scale with this powerful Apify actor. Extracts data, details & metadata with automatic pagination and proxy rotation. Perfect for market research, competitive intelligence, and data-driven decision making.

Donny Nguyen

Referrer-Policy Header Checker

scrappy_garden/referrer-policy-header-checker

Fetches URLs and validates the Referrer-Policy response header. Flags missing or risky policies (e.g., unsafe-url) and optionally checks against an expected policy. Outputs per-URL results plus SUMMARY and REPORT.

Bikram Adhikari

Website Security Auditor

zyrox/website-security-auditor

A powerful security tool to scan websites for exposed API keys and XSS vulnerabilities.

HIDDEN GHOST

SecurityNexus-AI Enterprise Security Platform

lovable_postcard/securitynexus-ai-clean-1

AI-powered enterprise security automation. $30+ revenue per run, $0.50-2.25 per threat. Perfect for SOCs, security teams, threat hunting. Real-time intelligence, professional reports. $72B market opportunity.