Passive HTTP Security Header Evidence API

Observe selected HTTP security headers, HSTS values and declared CSP directives with source evidence. Passive requests only; no vulnerability or safety claims.

Quick start

{
  "urls": [
    "https://www.python.org/"
  ]
}

Download the default dataset as JSON, CSV or Excel. Read OUTPUT before relying on completeness; source availability can change. Use sources you are authorized to access.

Documented behavior and limits

Returns a whitelist of security-related final-response headers, HSTS max-age when unambiguous, declared CSP tokens and evidence warnings. Cookie values, authentication headers and general response headers are not exported. CSP report-only is separate from enforcing CSP. Tokens such as unsafe-inline are observations, not vulnerability diagnoses: nonces, hashes and browser behavior can change their effect. HSTS on HTTP is not considered effective; max-age=0 is not positive-age evidence. No active exploit, port, malware, certificate-expiry or complete TLS audit. Successful HTTP 2xx responses only; failed sources incur no observation event. A missing header does not prove a vulnerable site, and presence does not prove safety.

Changes and snapshots

Each result includes itemKey, contentHash and observedAt. Pass SNAPSHOT.previousHashes in the next input. NO_BASELINE means no prior map; FIRST_SEEN means absent from a supplied map; UNCHANGED/CHANGED compare hashes. FIRST_SEEN does not prove newly created content. Snapshot contains only emitted rows. Missing rows are not deletions. No hidden persistence or scheduled tasks. For header observations, redirect trace is excluded from the hash; it remains in output. Other observations hash their normalized fields, excluding pagination source URL and time.

Pricing

$0.002 per emitted header observation ($2 per 1,000), plus $0.005 Actor-start at the default 256 MB. Higher memory can multiply startup events under Apify rules. Event-only pricing includes platform usage; no paid upstream API, proxy or browser. Failed sources incur no result event, but the start event can apply. An intentional missing-policy observation is billable for the robots product. Check Store pricing before running. Budget truncation sets PARTIAL_BUDGET and complete=false.

Network and data

Public HTTP(S), ports 80/443 only; credentials and private IPs rejected. DNS addresses are validated and pinned while TLS hostname verification stays enabled. Up to five redirects, 2 MiB decoded responses and approximately 95 seconds network budget. Site/content/spec fetches respect robots.txt; missing 404/410 policy allows access, unavailable/denied policy is an error. The robots product reads the policy file itself and never requests the evaluated page. No login, cookies, proxy, access-block workaround, external reference fetching or active security tests. All failed sources are reported; successful sources can continue. A run with no rows and source errors fails; valid empty collections/specs can succeed. Sources, redirects and their robots files are the only network targets. Inputs and output stay in your Apify run storage under platform retention; no separate customer analytics endpoint. Do not provide secrets.

Integration and support

POST https://api.apify.com/v2/actors/soilair~passive-http-security-header-evidence-api/runs with your Apify authorization header and input JSON. Poll the returned run and retrieve its defaultDatasetId and defaultKeyValueStoreId for OUTPUT/SNAPSHOT. Configure integrations/schedules in Console if needed; the Actor creates neither. Developed with AI assistance, fixtures and public-source/cloud checks. Examples do not establish arbitrary-source compatibility. Report a run ID and expected behavior through the issue tab without credentials.

Source specification: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Strict-Transport-Security