Security Headers Checker API | OWASP Audit

Bulk-audit websites for OWASP-recommended security headers. Get an A-F grade for each site with specific fix recommendations. Track changes between runs.

Store Quickstart

• Start with store-input.example.json to validate grading and output shape on three known URLs.
• If that matches your workflow, switch to store-input.templates.json and pick one of:
  • Quickstart (Dataset) for a cheap first run
  • Batch Audit for broader site portfolios
  • Weekly Compliance Monitor for recurring audits with snapshots
  • Webhook Alert for automated compliance notifications

The Store example keeps the first run small and deterministic while still returning the full scoring structure.

Who gets value fastest?

Team	Why
Security teams	Catch header regressions before or after releases
Agencies / MSPs	Audit many client sites on a repeatable schedule
Platform teams	Track hardened baselines across product domains

What does this actor do?

Sends a simple HTTP HEAD request to each URL and evaluates 10 OWASP-recommended security headers. Each site gets a score (0-100) and grade (A-F) with actionable fix suggestions.

Key Features

• 🛡️ 10 OWASP headers checked — HSTS, CSP, X-Frame-Options, Referrer-Policy, and more
• 📊 Security scoring — 0-100 with A-F grade per site
• 💡 Fix recommendations — Exact header values to add (e.g., Strict-Transport-Security: max-age=31536000)
• 🔄 Change tracking — Detects grade/score changes between runs
• 📋 Bulk processing — Check up to 200 URLs per run
• 🪝 Webhook + CI/CD — Use in security pipelines

Suggested recurring monitoring cadence

• Weekly portfolio sweeps using snapshotKey to track score drift
• Release-day checks on staging or production domains before rollout sign-off
• Webhook delivery for only the domains that regress and need action

Related security suite

• Pair with dns-dmarc-security-checker for domain-level email security posture
• Pair with ssl-certificate-monitor for expiry and issuer monitoring
• Use the trio as a recurring compliance workflow for client or internal portfolios

Headers Checked

Header	Weight	Why It Matters
Strict-Transport-Security (HSTS)	20	Forces HTTPS
Content-Security-Policy (CSP)	20	Prevents XSS
X-Content-Type-Options	10	Prevents MIME sniffing
X-Frame-Options	10	Prevents clickjacking
Referrer-Policy	10	Controls referrer leakage
Permissions-Policy	10	Restricts browser features
X-XSS-Protection	5	Legacy XSS filter
Cross-Origin-Opener-Policy	5	Isolates browsing context
Cross-Origin-Resource-Policy	5	Controls resource sharing
X-DNS-Prefetch-Control	5	Controls DNS prefetching

Input Example

{
  "urls": ["https://google.com", "https://github.com", "https://example.com"],
  "followRedirects": true,
  "concurrency": 5
}

Output Example

{
  "url": "https://github.com",
  "score": { "total": 75, "grade": "B" },
  "statusCode": 200,
  "headers": {
    "strict-transport-security": "max-age=31536000; includeSubdomains; preload",
    "x-frame-options": "deny",
    "x-content-type-options": "nosniff"
  },
  "score": {
    "total": 75,
    "grade": "B",
    "details": [
      { "header": "strict-transport-security", "status": "pass", "points": 20 },
      { "header": "content-security-policy", "status": "missing", "points": 0, "note": "Missing. Add a Content-Security-Policy header" }
    ]
  }
}

A fuller ready-to-share payload is available in sample-output.example.json for Store and README proof.

Cost

Zero external costs. Simple HTTP HEAD requests — no API keys, no proxies. A run checking 100 URLs takes ~15 seconds.

Store Listing Ops

npm run store:optimize
npm run store:kpi

Commercial Ops

Set up .env first:

$cp -n .env.example .env

Cloud Task/Schedule setup (idempotent):

$npm run apify:cloud:setup

Daily reliability checks:

npm run canary:check
npm run contract:test:live

OpenClaw cron commands:

• openclaw-cron-commands.md

Related actors

• dns-dmarc-security-checker — add DNS, SPF, DKIM, and DMARC checks for the same client/domain set.
• ssl-certificate-monitor — catch TLS expiry and issuer drift on the same sites.
• rdap-domain-monitor — track registrar and ownership changes behind the same web properties.