SSL & Security Headers Audit – TLS Certificate, HSTS, CSP Grader

Audit the TLS/SSL certificate and HTTP security headers of any list of websites in one run. Every site gets a 0–100 score, an A–F grade, a list of problems and plain-English fixes. Use it as a bulk SSL certificate checker, certificate expiry monitor, security headers scanner and HSTS / CSP checker for agencies, MSPs, security teams and DevOps.

No login, no browser, no proxy, no API key. It makes one TLS handshake and one HTTPS request per site, so runs are fast and cheap.

What you get for every site

• Certificate: issuer, subject, SAN list, valid-from and valid-to, days until expiry, key type and size, serial number, SHA-256 fingerprint, hostname match.
• TLS: negotiated protocol (TLS 1.3 / 1.2 / older), cipher, certificate chain trust and the chain itself.
• Security headers: Strict-Transport-Security (max-age, includeSubDomains, preload), Content-Security-Policy (unsafe-inline, unsafe-eval, wildcards), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP / CORP / COEP, and version leaks in Server / X-Powered-By.
• HTTP to HTTPS redirect check (port 80).
• Score, grade, issues (high/medium/low) and recommended fixes.

Use cases

• Certificate expiry monitoring across a client portfolio (schedule the Actor daily).
• Agency or MSP security reports and prospect audits.
• Find sites with missing HSTS or CSP, expired or mismatched certificates.
• Compliance checks before launches and penetration tests.

Input

Field	Description	Default
urls	Domains or URLs (private and internal addresses are rejected)	required
checkHttpRedirect	Check http:// redirects to https://	true
maxUrls	Cap per run (also caps cost)	500
concurrency	Parallel sites	8

{ "urls": ["github.com", "https://www.example.org/login", "yourclient.com"] }

Output (one item per site)

{
  "host": "github.com", "score": 94, "grade": "A",
  "tls": { "protocol": "TLSv1.3", "chainTrusted": true,
           "certificate": { "issuer": "Sectigo Limited", "daysUntilExpiry": 42, "sanCount": 2 } },
  "headers": { "hsts": { "maxAge": 31536000, "includeSubDomains": true }, "xContentTypeOptions": "nosniff" },
  "issues": [], "recommendations": []
}

Download as JSON, CSV or Excel, or call it through the Apify API.

Notes

• Sites that cannot complete a TLS handshake (no HTTPS, DNS failure, timeout) are listed in the ERRORS record and are not charged.
• Only publicly reachable hosts are scanned. The Actor performs passive checks (one handshake, one GET), not vulnerability scanning.
• Redirect check can show null if port 80 is unreachable.

Pricing

Pay per event: you are charged per site audited (one result each), plus a tiny start fee.