HTTP Security Headers Analyzer — CSP, HSTS Grader

HTTP Security Headers Analyzer Analyze and grade any site's HTTP security headers — CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy — with an A–F grade. No API key. Built for developers who need fast, reliable, bulk results without managing servers or proxies.

Features

• One structured JSON record per url.
• Bulk + concurrent — process up to 100 urls per run.
• No proxy, no browser, no API key — fast and low-cost.
• Graceful failures: unreachable inputs return ok: false with an error; the run never crashes.

Input

{"urls": ["https://github.com", "https://apify.com"], "maxItems": 100}

Output

One record per url:

{
  "url": "https://github.com",
  "ok": true,
  "status": 200,
  "grade": "A",
  "score": 9,
  "maxScore": 9,
  "present": ["HSTS", "CSP", "X-Frame-Options"],
  "missing": [],
  "headers": {"HSTS": "max-age=31536000"}
}

Who it's for

• Security engineers auditing web apps
• Pentesters & bug-bounty hunters
• DevSecOps CI gates
• Agencies running site security reports

How to use

1. Add your urls to the urls input field.
2. Run the Actor and read one structured record per input from the dataset.
3. Export as JSON, CSV, or Excel, or call the Actor's API from your backend.

FAQ

Do I need an API key? No. You provide urls; the Actor does the rest. Does it return personal data? No — only public infrastructure/metadata, never personal contact data. What formats can I export? JSON, CSV, and Excel via the dataset, or the Actor API.

Pricing

Pay-per-event: a tiny per-run start fee plus a small per-result charge. You pay only for successful results. See the Pricing tab.

Further reading

• Keyword: HTTP security headers analyzer.

Use HTTP Security Headers Analyzer with AI agents (MCP)

Give Claude, ChatGPT, Cursor, VS Code or any MCP client this Actor as a tool through the hosted Apify MCP server. The agent sees the input fields with descriptions and example values, runs the Actor, and reads the results.

MCP server URL (this Actor only):

https://mcp.apify.com/?tools=technicaldost/http-security-headers

Claude Code:

$claude mcp add --transport http apify "https://mcp.apify.com/?tools=technicaldost/http-security-headers" --header "Authorization: Bearer YOUR_APIFY_TOKEN"

Cursor, VS Code, Claude Desktop and other clients (mcp.json or the client's MCP settings):

{
  "mcpServers": {
    "apify": {
      "url": "https://mcp.apify.com/?tools=technicaldost/http-security-headers",
      "headers": { "Authorization": "Bearer YOUR_APIFY_TOKEN" }
    }
  }
}

Clients that support sign-in (such as Claude.ai connectors) can use the URL without a token and log in to Apify instead. Get your token in Apify Console → Settings → API & Integrations, or generate a ready config for your client at mcp.apify.com. In the agent the tool is named technicaldost--http-security-headers; ask it, for example, to "run HTTP Security Headers Analyzer with {"urls": ["https://github.com", "https://apify.com"]}".

AI agents without an Apify account can also run and pay for this Actor per request with x402 agentic payments.

Run HTTP Security Headers Analyzer via API

Run the Actor and get its results in one call (replace YOUR_APIFY_TOKEN):

curl -X POST "https://api.apify.com/v2/acts/technicaldost~http-security-headers/run-sync-get-dataset-items?token=YOUR_APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"urls": ["https://github.com", "https://apify.com"]}'

Python (pip install apify-client):

from apify_client import ApifyClient

client = ApifyClient("YOUR_APIFY_TOKEN")
run = client.actor("technicaldost/http-security-headers").call(run_input={"urls": ["https://github.com", "https://apify.com"]})
for item in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(item)

JavaScript / TypeScript (npm install apify-client):

import { ApifyClient } from 'apify-client';

const client = new ApifyClient({ token: 'YOUR_APIFY_TOKEN' });
const run = await client.actor('technicaldost/http-security-headers').call({"urls": ["https://github.com", "https://apify.com"]});
const { items } = await client.dataset(run.defaultDatasetId).listItems();
console.log(items);

Long runs: start them with POST /v2/acts/technicaldost~http-security-headers/runs and fetch the dataset when the run finishes, or receive a webhook.

Integrations

HTTP Security Headers Analyzer works with Make, Zapier, n8n, LangChain, Google Sheets, Slack, GitHub and webhooks. Schedule runs in Apify Console and send new results straight to your apps, spreadsheets or AI pipelines.

Related Actors

• GitHub Security Advisory Monitor — Track reviewed GitHub Security Advisories by ecosystem and severity
• SSL Certificate & Security Header Audit — Check TLS certificates and security headers for any list of domains. Returns issuer, expiry with days remainin