SecGrid Domain Security & Recon Scanner

Domain Security Scanner: SSL, Security Headers & Tech Stack

Check many websites in one run. For each domain you get an A+ to F security grade, the SSL/TLS certificate status and days until it expires, which security headers are present or missing, the server and technologies the site appears to use, and any public contact emails and social links found on the homepage.

Results go straight to JSON, CSV, Excel, the Apify API, Make, n8n or Zapier.

Who is it for?

• IT agencies, MSPs and security consultants who want to find websites with weak security and open a conversation with real evidence.
• Web and DevOps teams who need to watch many domains for expiring certificates.
• Anyone who needs a quick bulk health check before a migration, audit or acquisition.

What you get for each domain

Data	Details
Security grade and score	A+ to F, with a score out of 100
SSL/TLS	Certificate valid or not, issuer, days until expiry, TLS version
Security headers	Which of 6 important headers are present and which are missing
Server and technologies	IP address, server banner, and hints such as Cloudflare, Nginx, WordPress, Next.js
Page info	HTTP status, final URL, page title, meta description
Contacts (optional)	Public email addresses and LinkedIn / X / Facebook / Instagram links found on the homepage

How to use it

1. Open the Input tab and add your domains or URLs (for example example.com or https://www.example.com/page).
2. Choose whether to extract public contact emails.
3. Set the timeout per domain (default 10 seconds).
4. Click Start, then export the results as a table, JSON, CSV or Excel.

Input

Field	Description
domains	List of domains or URLs to check.
extractEmails	Look for public email addresses on the homepage. Default: on.
timeoutSecs	Maximum wait per domain, 3 to 30 seconds. Default: 10.

Example output (illustrative values)

{
  "domain": "example.com",
  "security_grade": "B",
  "security_score": "70/100",
  "http_status": 200,
  "ip_address": "203.0.113.10",
  "ssl_valid": true,
  "ssl_issuer": "Let's Encrypt",
  "ssl_days_remaining": 61,
  "ssl_protocol": "TLSv1.3",
  "detected_technologies": ["Nginx"],
  "server_software": "nginx",
  "security_headers_present": ["Strict-Transport-Security", "X-Content-Type-Options", "Referrer-Policy"],
  "security_headers_missing": ["Content-Security-Policy", "X-Frame-Options", "Permissions-Policy"],
  "public_emails": ["info@example.com"],
  "social_profiles": { "linkedin": "https://www.linkedin.com/company/example" },
  "page_title": "Example Domain",
  "audited_at_utc": "2026-01-01T12:00:00+00:00"
}

How the grade works

The grade is a quick first look, not a full audit:

• Valid SSL/TLS certificate: 40 points
• Each of these 6 headers present: 10 points each: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
• A+ is 90 or more, A 80 or more, B 65 or more, C 50 or more, D 35 or more, otherwise F.

Limitations (so there are no surprises)

• The grade checks whether headers are present, not whether their values are strong. It does not check email security (SPF/DMARC) or old TLS versions.
• Technology detection uses hints from headers and page text. It can be wrong, so treat it as a starting point.
• Emails are taken from the homepage text and are not verified. Many sites show no email at all. Use contact data responsibly and follow the laws that apply to you (for example GDPR and anti-spam rules).
• Sites with bot protection may answer differently or block the request.
• This is an outside-in check. It does not replace a penetration test.

Safe and light

The Actor uses public information only. For each domain it makes one DNS lookup, one TLS connection and one page request. No port scanning, no crawling, no attacks. Please only check domains you own, manage or have a legitimate reason to assess.

Pricing

Currently free to use. You only pay Apify platform usage, which is small. Pay-per-event pricing is planned, and any price change will be announced at least 14 days in advance.

Support

Found a bug or need another check? Open an issue on this Actor page or email secgrid.support@gmail.com. We reply within 1 to 2 business days.