HTTP Security Headers Audit & Grade

Audit the HTTP security headers of hundreds of websites in one run. Each site gets an A+ to F grade, a 0–100 score, a pass/warn/fail result for every check, and a prioritized list of fixes with copy-paste header examples.

• 🔒 Checks 20+ items: HSTS, Content-Security-Policy (directive by directive), X-Frame-Options / CSP frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP / COEP / CORP, deprecated headers, information leaks, cookies, CORS, HTTP→HTTPS redirect, HTTPS availability and mixed content.
• 🧠 Real CSP analysis, not just "present or missing". It flags 'unsafe-inline', 'unsafe-eval', wildcard and https: script sources, a missing default-src, object-src, base-uri and frame-ancestors, and report-only policies that are not enforced. Nonce- and hash-based 'strict-dynamic' policies are recognised as strict.
• 🍪 Cookie audit: Secure, HttpOnly and SameSite flags for every Set-Cookie header (including cookies set on redirects), plus __Host- and __Secure- prefix rules.
• 🛠️ Actionable output: every finding comes with a recommendation, and the recommendations are sorted high → medium → low with an example header value.
• 🔁 Redirect chain recorded hop by hop. Plain domains are tried over HTTPS first, then HTTP.
• ⚡ Fast and lightweight: HTTP requests only (no browser) and one request per site, plus one for the redirect check.
• 💸 Failed sites are free. Invalid URLs, DNS failures, unreachable hosts and 5xx responses are not charged.

Use cases

• Agencies and MSPs: run a monthly security-header report across every client website.
• Pentest and compliance teams (ISO 27001, SOC 2, PCI DSS, OWASP ASVS): run quick baseline checks before a deeper assessment.
• Vendor risk and third-party assessment: grade the public web posture of suppliers in bulk.
• DevSecOps: schedule the Actor and alert when a grade drops after a deploy.
• Sales prospecting for security services: find sites with an F grade and include concrete fixes in your outreach.

Input

Field	Type	Default	Description
urls	array of strings	–	Websites to audit. Plain domains (example.com) or full URLs. Duplicates are removed. Invalid entries are reported as failed items and are free.
followRedirects	boolean	true	Follow up to 10 redirects and audit the final page. The redirect chain is always recorded.
checkHttpToHttps	boolean	true	Also request http:// to verify that it redirects to HTTPS. For http:// inputs, this also checks whether HTTPS is available.
concurrency	integer	10	Number of websites audited in parallel (1–50).

{ "urls": ["https://github.com", "example.com", "https://www.mozilla.org"] }

Output

The Actor outputs one dataset item per website. The Console offers these views: Grades overview, All checks (one row per check), Recommendations and Cookies. This example is trimmed from a real run:

{
  "url": "https://www.mozilla.org/",
  "finalUrl": "https://www.mozilla.org/en-US/",
  "statusCode": 200,
  "https": true,
  "httpsAvailable": true,
  "httpRedirectsToHttps": true,
  "redirectChain": [
    { "url": "https://www.mozilla.org/", "statusCode": 302, "location": "https://www.mozilla.org/en-US/" },
    { "url": "https://www.mozilla.org/en-US/", "statusCode": 200, "location": null }
  ],
  "grade": "B",
  "score": 78,
  "checks": [
    { "id": "hsts", "header": "Strict-Transport-Security", "present": true, "value": "max-age=31536000",
      "status": "warn", "message": "HSTS is set but without includeSubDomains.",
      "recommendation": "Add includeSubDomains once all subdomains support HTTPS.", "scoreImpact": -2 },
    { "id": "csp", "header": "Content-Security-Policy", "present": true, "value": "script-src 'self' 'unsafe-eval' 'unsafe-inline' … ; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; …",
      "status": "fail",
      "message": "CSP present but weak — script-src: 'unsafe-inline' allows inline scripts, defeating most XSS protection. script-src: 'unsafe-eval' allows eval() and similar.",
      "recommendation": "Tighten the policy: use nonces/hashes with 'strict-dynamic' instead of 'unsafe-inline'/host allowlists, and set object-src 'none' and base-uri 'none'.",
      "scoreImpact": -15 }
  ],
  "missingHeaders": ["Permissions-Policy"],
  "leakedInfo": [],
  "cookies": [],
  "mixedContent": { "count": 0, "examples": [] },
  "recommendations": [
    { "priority": "high", "header": "Content-Security-Policy", "recommendation": "Tighten the policy: …",
      "example": "Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-{RANDOM}' 'strict-dynamic'; object-src 'none'; base-uri 'none'; frame-ancestors 'self'; form-action 'self'" },
    { "priority": "low", "header": "Permissions-Policy", "recommendation": "Disable browser features the site does not use.",
      "example": "Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=(), usb=()" }
  ],
  "responseHeaders": { "…": "all response headers of the final page" },
  "success": true,
  "error": null
}

Cookie entries look like this: { "name": "PHPSESSID", "secure": false, "httpOnly": false, "sameSite": null, "issues": ["Missing Secure flag …", "Missing HttpOnly …", "No SameSite attribute …"] }.

Failed items have success: false, an error such as "Domain not found (DNS lookup failed)", "Invalid URL" or "HTTP 503", and are not charged.

Scoring rubric

Every site starts at 100. The deductions below are applied, and the score is clamped to 0–100. The rubric is similar in spirit to securityheaders.com and Mozilla Observatory, but it is fully transparent: each check's scoreImpact shows exactly what it cost.

Check	Condition	Points
HTTPS	Page served over plain HTTP	−40 (grade capped at F)
HTTP → HTTPS	http:// does not redirect to HTTPS	−15
Strict-Transport-Security	Missing, invalid or max-age=0	−20
	max-age < 15552000 (180 days)	−10
	No includeSubDomains	−2
Content-Security-Policy	Missing	−25
	Only Content-Security-Policy-Report-Only	−20
	Present but weak: no script restriction −15, 'unsafe-inline' without nonce/hash −10, wildcard/https:/data:/http: script sources −10, 'unsafe-eval' −5, no default-src −3, object-src not 'none' −3, no base-uri −2	up to −25
Clickjacking	No X-Frame-Options (DENY/SAMEORIGIN) and no CSP frame-ancestors, or invalid value	−20
	ALLOW-FROM (unsupported)	−10
X-Content-Type-Options	Missing or not nosniff	−5
Referrer-Policy	unsafe-url / no-referrer-when-downgrade −5, missing −3, origin / origin-when-cross-origin −2
Permissions-Policy	Missing	−5
Cross-Origin-Opener-Policy	Missing or unsafe-none	−2
COEP / CORP	Not set	0 (info)
Deprecated headers	X-XSS-Protection other than 0 −2, Public-Key-Pins −2. Expect-CT and Feature-Policy are flagged (0).
Information leaks	Server header with a version, X-Powered-By, X-AspNet-Version, X-AspNetMvc-Version, X-Generator	−3 each, max −10
Cookies	Missing Secure (on HTTPS) −5, session/auth cookie without HttpOnly −5, missing SameSite −2, invalid prefix/SameSite −3	max −15
CORS	Access-Control-Allow-Origin: * with credentials −10, null origin −5
Mixed content	http:// scripts, stylesheets or iframes on an HTTPS page	−10

Grades: A+ ≥ 95 with no failed check · A ≥ 85 · B ≥ 70 · C ≥ 55 · D ≥ 40 · E ≥ 25 · F < 25 or no HTTPS.

Pricing

Pay per event: you only pay for websites that were successfully audited.

Event	Price
Site audited	$0.002 per site ($2 per 1,000 sites)
Actor start	$0.00005 per run

Invalid URLs, unreachable hosts, DNS failures and 5xx responses are free. If you set a maximum cost per run, the Actor audits only as many sites as fit within it.

FAQ

Is it the same as securityheaders.com or Mozilla Observatory? No. It is an independent tool with its own rubric (documented above). Grades are comparable in spirit but not identical. This Actor is not affiliated with securityheaders.com, Snyk or Mozilla.

Which page is audited? The final page after redirects (unless followRedirects is off). Cookies set on intermediate redirects are included.

Why did a site get a 403 but still a grade? Responses with status codes below 500 still carry the site's (or its CDN's) security headers, so they are audited. Check statusCode if a WAF is blocking the request.

Is this a penetration test? No. The Actor makes ordinary, polite GET requests to public pages, similar to a browser visit. It does not attack or probe anything.

What does mixed content detection cover? It is a quick HTML scan for http:// scripts, stylesheets, iframes and objects on HTTPS pages. Content that JavaScript loads dynamically is not covered.

Changelog

• 0.1: Initial release. Grades, CSP/HSTS/cookie/CORS analysis, prioritized recommendations, redirect chain and HTTP→HTTPS check.