Website Security Monitor

Check the transport and header setup of public websites. Each site gets one row: a score from 0 to 100, a letter grade, and a short list of fixes in plain language.

Not legal advice; general information only.

This flags likely issues. It is not a security certification or a penetration test.

What you get

For each public website:

• TLS certificate: who issued it, how many days are left, whether the name matches, whether the chain is trusted, and which TLS versions the server accepts.
• Whether HTTP sends visitors to HTTPS.
• Security headers: HSTS (including max-age and preload), Content-Security-Policy, framing protection, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy.
• Whether the home page loads scripts, frames, images or media over plain HTTP.
• Cookie flags only: Secure, HttpOnly, and SameSite, listed by cookie name. Cookies set by JavaScript after the page loads are not seen, because this check does not run a browser.
• Whether /.well-known/security.txt is present, and whether its expiry date has passed.

A certificate that expires within Certificate expiry warning days is called out, so a weekly schedule still leaves time to renew. The default is 21 days.

Unreachable sites are stored with no score and are not charged. Private addresses, internal names, and URLs on a port other than 80 or 443 are skipped and are not charged. The summary counts every URL you supplied, how many were accepted, and how many of those unsafe URLs were skipped. A run whose addresses are all private still finishes, with nothing checked. A public site that redirects to a private address is stored with that finding and is not charged.

What is not collected

Cookie values are never saved. Page text and HTML are not saved. IP addresses are not saved. Query strings and fragments are not saved. security.txt contact addresses are not saved. Header checks keep the graded facts, not the raw policy text.

How to use it

1. Open the Actor and paste one or more public website URLs under Website URLs. Use a full URL such as https://example.com/.
2. Leave Certificate expiry warning at 21 for a weekly run, or raise it if you want earlier notice.
3. Set Max sites if you want a hard cap on the bill.
4. Start the run. Open the dataset for one row per site, or the REPORT record in the key-value store for the same findings as a page.

Client-ready report

Use this when you want one file to send to a client. It is off by default. Off does not add a file and does not add a fee.

1. Paste the websites you want to check.
2. Set Client-ready report to HTML.
3. Run the Actor.
4. Open the Output tab. Client report (HTML) is REPORT.html in the key-value store. Client report summary lists that key.

The page has a cover with the site, the date and an overall grade, a short summary in plain language, and a table of findings. Each finding says what it means and how to fix it. A run with more than one site has a section per site. Pass, warning and fail stay readable in black and white. The footer says Generated with Website Security Monitor.

The report fee is charged once per run, and only after the file is saved. A failed save is not charged. The dataset and the existing REPORT summary stay included in the site fee. This Actor saves HTML. It does not save a PDF.

Weekly monitor

In the Apify console, create a schedule for this Actor (for example every Monday) and save the input with your site list. Each run charges the start fee plus one site fee for every site that answered. A site that is down is listed and is free, so the schedule can show an outage without a site fee.

Pricing

You pay a small fee when the run starts, plus a fee for each public website that could be checked.

Event	Price
Run start	$0.00005
Site checked	$0.005
Client-ready report	$0.02

The site fee covers the certificate, the header check, the home page and security.txt. Unreachable sites are not charged. Private addresses are not charged. The client-ready report is charged once per run, only when that file is saved. Leave Client-ready report on Off and that fee is not charged. Add $0.02 to any example below when the report is saved.

Examples

• 1 site: $0.00505
• 10 sites: $0.05005
• A run where every site is down or private: $0.00005

Input

Field	Default	What it does
Website URLs	empty	Public sites to check. One row each.
Certificate expiry warning (days)	21	Flag certificates that expire soon.
Max sites	10	Cap how many sites one run will check.
Concurrency	2	How many sites to check at the same time.

Output

The dataset has one item per site. The overview table shows the score, the grade, days until the certificate expires, whether HTTP redirects to HTTPS, whether HSTS is set, and whether security.txt was found. The item also lists the fixes, highest impact first.

The key-value store record REPORT is an HTML page of the same findings. OUTPUT is the summary used to build that page.

Limits

Up to 50 websites in one run. Each request times out, redirects are capped, and response bodies are capped. Only http and https URLs on ports 80 and 443 are accepted.

Disclaimer

These findings flag likely issues. This is not a security certification or a penetration test. A high score does not mean the site is safe against every attack.

Next additions

• Agency white-label logo
• Dutch report