SSL Certificate Expiry & Security Headers Checker

Check the HTTPS set-up of many websites in one run. For each website's homepage you get:

• SSL/TLS certificate: trusted or not (and why), issuer, names covered, valid from / expires, days left, TLS version and cipher
• Redirects: whether http:// redirects to https://, with the full redirect chain (up to 5 hops)
• Security headers: Strict-Transport-Security (max-age, includeSubDomains, preload), Content-Security-Policy (and report-only), CSP frame-ancestors, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy, plus the Server and X-Powered-By values
• Cookie flags: each cookie's name with its Secure, HttpOnly and SameSite flags (cookie values are never read or stored)
• Grade A to F and a score out of 100, with a plain list of issues

Use it for

• Agencies and freelancers: schedule a weekly run over your client sites and catch certificates that expire in under 30 days before the client notices.
• IT and web teams: a quick header hygiene report across all your domains.
• Pre-launch checks: confirm a new site redirects to HTTPS and sends HSTS and the basic security headers.

Example input

{
  "websites": ["example.com", "https://www.yourclient.co.uk"],
  "maxConcurrency": 5
}

Output fields

input, host, finalUrl, grade, score, issues, error, note, httpsWorks, httpRedirectsToHttps, httpsRedirects, httpRedirects, statusCode, hsts, hstsMaxAge, hstsIncludeSubdomains, hstsPreload, csp, cspReportOnly, cspFrameAncestors, xFrameOptions, xContentTypeOptions, referrerPolicy, permissionsPolicy, crossOriginOpenerPolicy, server, poweredBy, cookies, tlsVersion, cipher, certValid, certError, certIssuer, certIssuerOrg, certSubject, certNames, certNotBefore, certExpires, certDaysLeft, checkedAt.

Inputs that point to the same host are checked and charged once: example.com, EXAMPLE.com/page and http://example.com:443 are one website (www.example.com is a different host). Each website in the output is one charged event (site-checked), including sites that return an error (for example "the domain does not resolve").

How the grade works

The score starts at 100 and loses points for: HTTPS not working (F), an untrusted or expired certificate, a certificate expiring within 30 days, TLS 1.0/1.1, no HTTP to HTTPS redirect, no HSTS (or max-age under 180 days), no CSP, no clickjacking protection, no nosniff, no Referrer-Policy, no Permissions-Policy, cookies without Secure, and an X-Powered-By header. A = 90+, B = 75+, C = 60+, D = 45+, E = 30+, F below 30.

The grade is a header and configuration best-practice grade, based on the OWASP Secure Headers Project and MDN's HTTP security guidance. It is a quick hygiene indicator from what the server returns. It is not a vulnerability scan, penetration test or security guarantee: a site can score A and still be insecure, and a low score doesn't mean a site has been breached.

Exactly what the actor does per website

1. Resolves the domain and refuses private, loopback, link-local and reserved addresses. Every connection (including each redirect hop and robots.txt) is opened to an address that passed this check, so a DNS answer that changes mid-run can't redirect a request to a private network. Only ports 80 and 443 are used, environment proxies are ignored, and credentials in redirect URLs are stripped.
2. One TLS handshake on port 443 to read the certificate (IPv4 first; a second, unverified handshake only when the certificate isn't trusted, so its details can still be shown).
3. Reads /robots.txt once per host with its own User-Agent. If robots.txt disallows / for this checker or for all robots, the homepage is not fetched and the row says so (the certificate is still reported).
4. A GET of https://host/ and of http://host/, following redirects by hand (max 5 hops, each hop's host also checked against its robots.txt for that path). Only the response headers are read; the page body is never downloaded or stored.

Nothing else: no other paths, no crawling, no port scans, no probing for files or admin pages, no payloads, no logins or forms, no proxies. If a site answers 401/403/429/503 or shows a bot check, that answer is reported as it is (headers shown, no grade) and never worked around. A path in your input (https://site.com/page) is ignored: only the homepage is checked. IP addresses are not accepted (domain names only), and redirects to a bare IP address are not followed. A Crawl-delay in robots.txt is honoured between requests to the same host (up to 2 minutes; a site asking for longer gets only the first request).

User-Agent: Mozilla/5.0 (compatible; SecurityHeadersCheck/1.0; +https://apify.com/velveteen_driver/website-security-headers-checker)

Limits

• Up to 1,000 websites per run; up to 20 different websites are checked at the same time (default 5). Requests to any one host are made one at a time, including redirect targets shared by several inputs. Not for load testing or uptime pinging.
• Headers are read from the homepage only; other pages of a site may send different headers.
• Sites that block automated visitors in robots.txt get a certificate result only.

Data source and responsible use

• The only data source is the websites you supply: the certificate and response headers each server sends to any visitor. No third-party databases or APIs are used.
• Only submit websites you own, manage or have permission to assess, and comply with the law that applies to you. Use the results to fix or advise, not to publicly name or shame site owners.
• Any future feature that finds hosts by itself (subdomain discovery, certificate-transparency lists, bulk internet-wide lists) is out of scope for this actor.
• Certificates are reported as the server presents them. The actor stores no page content and no cookie values.