HTTP Security Headers Checker

Audit security headers for any list of websites and get a clean dataset with a grade, score, missing headers and practical recommendations.

Example result:

{
    "domain": "apify.com",
    "grade": "A",
    "score": 95,
    "missingHeaders": ["permissions-policy"],
    "hasHsts": true,
    "hasCsp": true,
    "finalUrl": "https://apify.com/",
    "scrapedAt": "2026-07-09T10:30:00.000Z"
}

How to use it

1. Paste one or more domains or URLs.
2. Choose the maximum number of URLs to check.
3. Start the Actor and export the dataset as JSON, CSV or Excel.

Pricing

Usage-based pricing, no subscription:

Event	Price
Actor start	$0.005
Checked URL	$0.0005

1,000 checked URLs cost about $0.505.

Output fields

Field	Type	Always present?
domain	string	Yes
url	string	Yes
finalUrl	string	Yes
statusCode	number	No
grade	string	Yes
score	number	Yes
missingHeaders	array	Yes
recommendations	array	Yes
headers	object	Yes
scrapedAt	ISO date	Yes

Limitations

• Checks response headers only; it does not run a browser security scan.
• Follows redirects and grades the final HTTP response.
• A grade is a practical audit signal, not a formal compliance certification.

Verified automation package

The following reproducible example comes from successful Apify run cXctz4lpAeBsGlqLH. See the full Q Services technical guide and the tested n8n automation example.

Auditez une liste bornée de domaines, suivez la réponse finale après redirection et obtenez pour chaque cible un score, une note, les en-têtes absents et des recommandations exploitables. Programmez le contrôle pour détecter les régressions sans présenter le résultat comme une certification.

High-value use cases

• Contrôle hebdomadaire d’un portefeuille de domaines
• Détection de régressions HSTS ou CSP après déploiement
• Audit multi-sites pour une agence web
• Transmission des écarts vers un ticket ou un tableau interne
• Vérification des en-têtes après un changement de CDN

Target audience: Responsables sécurité, agences web et équipes plateforme qui gèrent plusieurs domaines publics

Growth hypothesis: Un positionnement axé sur la surveillance hebdomadaire multi-sites et un workflow n8n relié à une destination opérationnelle feront passer les runs publics sur trente jours de la référence actuelle de 10 à au moins 15 à J+30, en favorisant les usages récurrents plutôt que les audits ponctuels.

Tested input

{
  "startUrls": [
    "https://example.com"
  ],
  "maxResults": 1,
  "proxyConfiguration": {
    "useApifyProxy": false
  }
}

Clean output sample

[
  {
    "domain": "\u003cstring\u003e",
    "url": "\u003cstring\u003e",
    "finalUrl": "\u003cstring\u003e",
    "status": "\u003cstring\u003e",
    "statusCode": "\u003cstring\u003e"
  }
]

API example

$curl --request POST   'https://api.apify.com/v2/acts/GWUbdt1hxWioYEEZA/runs?waitForFinish=120&maxTotalChargeUsd=0.05'   --header "Authorization: Bearer $APIFY_TOKEN"   --header 'Content-Type: application/json'   --data @input.json

Measured cost and limits

The proof run took 2.61 seconds and reported $0.000598 in platform usage. Actual cost depends on input size and source behavior. Set an Apify maximum charge per run and conservative result limits.

Known limits:

• Public sources can change or become unavailable.
• Output completeness depends on the supplied input.
• The measured proof cost is evidence for one run, not a universal quote.

Run HTTP Security Headers Checker on the Apify Store.