Security Headers Checker: Bulk Website Header Audit

Security headers are one of the easiest wins on a website, and loads of sites still don't have them. This checks a whole list of sites in one go and grades each one A to F.

You get what's there, what's missing, anything set up badly (like a CSP that allows unsafe-inline), cookies without Secure or HttpOnly, and exactly what to add.

What it does

• Grades HTTP security headers A-F per URL
• Lists missing headers with specific fixes
• Flags cookies without Secure/HttpOnly/SameSite
• Rejects private/internal addresses
• Reports failures per URL without stopping the run

Use cases

• Checking all your client or company sites at once instead of one at a time.
• Finding quick security fixes to send over to a web team or host.
• Making sure a deploy didn't quietly drop your headers.
• Adding a security bit to SEO or web audits for prospects.
• Running it on a schedule to catch it if something changes.

How to use

1. Add website URLs or domains to the list.
2. Hit Start. Each site takes a second or two.
3. Download the table or grab it through the Apify API.

You can also call it from the Apify API, run it on a schedule, or hook it up to Make, Zapier or n8n. AI agents can use it through Apify's MCP server.

Input

{
  "urls": [
    "https://example.com",
    "https://example.org"
  ]
}

Output

You get one row per result, with these fields: url, finalUrl, status, grade, score, present, missing, issues, recommendations, error.

Pricing

$0.0024 per url audited. You only pay for results that work. Anything that fails comes back with an error and is free. You can set a max spend per run in the run options.

So 100 URLs cost about $0.24, and 1,000 about $2.40.

FAQ

What does the grade mean?

It's based on which of the important headers are there and whether they're set up properly. A means you're sorted, F means there's basically nothing.

Does it hack or scan anything?

No. It just reads the headers a site sends back on a normal visit, nothing more.

Why do some sites say 'blocked'?

Some sites block automated visits and send back an error page instead. That page doesn't have the real headers, so it isn't graded and you aren't charged.

Can it check pages behind a login?

No, only public pages. Private and internal addresses are refused.

Limitations

• It checks the page you give it. Other pages on the same site can send different headers.
• A good grade is a good sign, not a full security review.

Other tools you might like

• Website Tech Stack Detector: what a website is built with: CMS, frameworks, analytics, hosting.
• Sitemap URL Extractor & XML Sitemap Checker: pull every URL out of a site's sitemaps and check them for problems.
• Package Health Checker: check npm and PyPI packages for vulnerabilities, licences and abandonment.

Support

This Actor is built and maintained by an automated system run by its publisher. If something's wrong, open an issue and it'll be looked at within 7 days. Please don't put passwords or personal details in an issue.