HTTP Security Headers Checker 🛡️

Check HTTP security headers (HSTS, CSP, X-Frame-Options and more) for any list of URLs and get an instant A–F security grade. Perfect for security audits, compliance reporting, DevOps pipelines, and continuous website monitoring.

Give the actor a list of URLs and it fetches each one with a real Chrome browser fingerprint, follows redirects, and reports exactly which security headers are present, which are missing, and an overall grade — one clean row per URL.

---

✨ What it checks

For every URL the actor inspects the response headers and returns:

Category	Headers
Core (drive the grade)	Strict-Transport-Security (HSTS), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
Informational	X-XSS-Protection, Cross-Origin-Opener-Policy, Server, X-Powered-By
Cookies	Whether Set-Cookie uses the Secure flag
Transport	Final URL after redirects, HTTP status code, HTTPS detection

The grade (A–F) and score (0–6) are computed from how many of the six core headers are present, and missing_headers[] lists exactly what to fix.

---

🚀 Input

{
  "startUrls": [
    "https://www.apify.com",
    "https://www.github.com"
  ],
  "maxItems": 100
}

Field	Type	Description
startUrls	array	List of website URLs to check. Bare domains are auto-prefixed with https://.
maxItems	integer	Max URLs to process (default 100, max 1000).

---

📤 Output

One item per URL:

{
  "url": "https://www.github.com",
  "final_url": "https://github.com/",
  "status_code": 200,
  "is_https": true,
  "grade": "B",
  "score": 5,
  "hsts": "max-age=31536000; includeSubdomains; preload",
  "csp": "default-src 'none'; ...",
  "x_frame_options": "deny",
  "x_content_type_options": "nosniff",
  "referrer_policy": "origin-when-cross-origin, strict-origin-when-cross-origin",
  "permissions_policy": null,
  "x_xss_protection": "0",
  "cross_origin_opener_policy": "same-origin",
  "server": "GitHub.com",
  "x_powered_by": null,
  "cookies_secure": true,
  "missing_headers": ["Permissions-Policy"],
  "scraped_at": "2026-07-03T09:00:00+00:00"
}

---

💡 Use cases

• Security audit — quickly grade dozens of properties and get a prioritized list of missing headers.
• Compliance — evidence for SOC 2 / ISO 27001 / PCI reviews that HSTS and CSP are deployed.
• DevOps / CI — fail a pipeline when a deploy drops a header or downgrades HTTPS.
• Monitoring — schedule a run and alert when a site's grade regresses.

---

💰 Pricing

Pay-as-you-go, roughly $1 per 1,000 URLs checked (input) plus platform usage. Each input URL produces one output JSON item, so cost scales linearly and predictably with the number of URLs you scan.

---

🔍 Comparison

	This actor	DIY curl script	Web-based scanners
Bulk URLs	✅ up to 1,000/run	⚠️ manual loop	❌ one at a time
Structured JSON	✅	⚠️ parse yourself	⚠️ export limited
A–F grade + missing list	✅	❌	✅
Browser fingerprint (avoids blocks)	✅ Chrome 124	❌	varies
Scheduling / API / integrations	✅ Apify	❌	⚠️

---

🔗 Related actors

• SSL Certificate Checker
• DNS Records Scraper
• Website Tech Stack Detector
• SEO On-Page Auditor

---

🛟 Support

Questions or a header you'd like added? Open an issue or contact us through the Apify actor page — we respond fast.

---

Keywords: security headers checker, HSTS checker, CSP checker, X-Frame-Options, HTTP security scanner, security grade, header audit, website security scanner, referrer-policy, permissions-policy, compliance, devops security.