SSL Certificate & Security Headers Checker

A fast, no-browser check of your TLS certificate and HTTP security posture. Point it at one or more URLs and get back certificate expiry, validity, and which of the standard security headers (HSTS, CSP, X-Frame-Options, and more) are actually present -- plus a letter grade, a 0-100 score, a severity tag, and a plain-English issue list.

What you get, per URL

• A letter grade (A+ to F) and 0-100 score summarizing security posture at a glance
• A one-line executive summary ("3 issue(s) found -- review recommended")
• A severity tag -- critical (no HTTPS, invalid/expired cert, or expiring within 7 days), warning (header gaps or other issues), or ok -- for instant triage
• Certificate validity and trust -- whether the certificate is trusted by standard root CAs, its issuer, subject, and validity window
• Days until expiry -- so you can catch a renewal before it lapses, not after
• HTTP-to-HTTPS redirect check -- confirms plain http:// traffic is actually redirected to https://
• Security header presence: Strict-Transport-Security (HSTS), Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy
• Hosts are checked in parallel (configurable, up to 20 at once), so a batch of 50 URLs finishes in a fraction of the time a one-by-one check would take

Why this instead of checking manually

	Manual spot-checks	SSL & Security Headers Checker
Coverage	One host at a time, in a browser dev tools panel	Every host you list, automatically
Speed	Minutes per host	Seconds, via parallel checking
Triage	You read raw headers yourself	Pre-classified severity + letter grade
Repeatability	Forgotten until the cert expires	One click, or schedule it
Output	Screenshots or notes	Structured dataset, exportable to CSV/JSON/BI tools

Who this is for

• Developers and DevOps engineers doing a pre-launch or periodic security sanity check
• Anyone who's been burned by an expired certificate taking a site down unexpectedly
• Agencies auditing a client's sites for basic security hygiene
• Teams wiring a certificate-expiry or header-regression check into a scheduled monitor

How to use it

1. Add one or more URLs to check.
2. Adjust warn if certificate expires within (days) if you want an earlier or later heads-up than the 30-day default.
3. Tune concurrency (default 5) to trade speed for gentleness on slow or rate-limited servers.
4. Run it once for a snapshot, or put it on an Apify Schedule so you get advance warning before a certificate expires or a security header regresses.

Example output (one item)

{
  "url": "https://example.com/",
  "finalUrl": "https://example.com/",
  "statusCode": 200,
  "score": 40,
  "grade": "F",
  "severity": "warning",
  "summary": "6 issue(s) found -- review recommended.",
  "issueCount": 6,
  "issues": [
    "TLS certificate expires in 45 day(s).",
    "Missing Strict-Transport-Security (HSTS) header.",
    "Missing Content-Security-Policy header.",
    "Missing X-Content-Type-Options header.",
    "Missing X-Frame-Options header (clickjacking protection).",
    "Missing Referrer-Policy header."
  ],
  "usesHttps": true,
  "certValid": true,
  "certIssuer": "DigiCert Inc",
  "certDaysRemaining": 45,
  "hsts": false,
  "csp": false,
  "checkedAt": "2026-08-22T00:00:00.000Z"
}

Pricing

This Actor uses pay-per-event pricing:

• Host checked -- charged once per URL processed, whether the check succeeded or the connection failed (a failed connection is still a useful signal -- your certificate or server may be down).

Parallel checking doesn't cost more -- it just finishes faster.

FAQ

How does this read the certificate without a browser? It opens a raw TLS connection to the host (the same handshake a browser performs) using Node's built-in TLS module, and reads the certificate the server presents -- no headless browser needed, which keeps this fast and cheap to run.

Does it check the full certificate chain? It reports on the trust result reported by Node's TLS stack against standard root certificate authorities, plus the leaf certificate's issuer, subject, and validity window. It does not enumerate every intermediate certificate individually.

What makes something "critical" vs. a "warning"? critical covers anything that puts the site itself at risk right now: no HTTPS at all, an invalid or untrusted certificate, or a certificate expiring within 7 days. warning covers everything else that lowers the score, most commonly missing security headers -- worth fixing, but not an active outage risk.

Will higher concurrency get me rate-limited? It can, on servers or WAFs with aggressive rate limiting. Start at the default (5) and lower it if you see timeouts spike for a particular host.

Is the score a substitute for a full security audit? No. It's a fast, transparent first-pass signal covering certificate health and the most common security headers. A full security review also covers things like TLS protocol/cipher configuration, cookie flags, CORS policy, and application-level vulnerabilities, which are out of scope here by design.

Does this send any data anywhere besides your own Apify account? No. It only opens standard TLS connections and HTTP requests to the URLs you provide and returns what it finds -- no login, no third-party analytics calls.