👁 Security Headers Checker — OWASP Audit & Grading avatar

Security Headers Checker — OWASP Audit & Grading

Pricing

$4.00 / 1,000 url security checks

👁 Security Headers Checker — OWASP Audit & Grading

Security Headers Checker — OWASP Audit & Grading

Audit 12 HTTP security headers (HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, COOP, CORP, COEP). A-F grading, actionable recommendations. 5 URLs free.

Pricing

$4.00 / 1,000 url security checks

Rating

0.0

(0)

Developer

👁 Manchitt Sanan

Manchitt Sanan

Maintained by Community

Actor stats

Bookmarked

Total users

Monthly active users

a month ago

Last modified

What it checks

Header	Weight	What it prevents
Strict-Transport-Security (HSTS)	15%	Downgrade attacks, SSL stripping
Content-Security-Policy (CSP)	15%	XSS, code injection
X-Content-Type-Options	10%	MIME type sniffing
X-Frame-Options	10%	Clickjacking
Referrer-Policy	10%	Information leakage
Permissions-Policy	10%	Unauthorized feature access (camera, mic, location)
X-XSS-Protection	5%	Legacy XSS filter (deprecated, CSP preferred)
Cross-Origin-Opener-Policy	5%	Cross-origin window attacks
Cross-Origin-Resource-Policy	5%	Unauthorized resource embedding
Cross-Origin-Embedder-Policy	5%	Spectre-class side-channel attacks
Cache-Control	5%	Sensitive data caching
X-Permitted-Cross-Domain-Policies	5%	Flash/PDF cross-domain access

Grading

Grade	Score	Meaning
A+	95-100	Excellent — all critical headers present and configured
A	85-94	Good — minor improvements possible
B	70-84	Acceptable — some headers missing
C	50-69	Needs work — several security gaps
D	30-49	Poor — significant exposure
F	0-29	Failing — critical headers missing

Quick start

{
"urls":["https://google.com","https://github.com"]
}

Input

Field	Type	Default	Description
`urls`	array	(required)	URLs to audit
`timeout`	integer	`10000`	Request timeout in ms
`webhookUrl`	string	(optional)	POST alert when any site gets D or F grade
`dryRun`	boolean	`false`	Audit without charges

Output

{
"url":"https://example.com",
"grade":"C",
"score":55,
"headers":[
{
"header":"strict-transport-security",
"present":true,
"value":"max-age=31536000; includeSubDomains",
"status":"pass",
"recommendation":"Present and correctly configured",
"weight":15
},
{
"header":"content-security-policy",
"present":false,
"value":null,
"status":"fail",
"recommendation":"Add Content-Security-Policy header. Start with: default-src 'self'; script-src 'self'",
"weight":15
}
],
"summary":{"passed":5,"warnings":3,"failed":4,"total":12},
"status":"success"
}

Pricing

$0.003 per URL checked (pay-per-event pricing).

Errors and dry runs are never charged.
100 URLs = $0.30

Related actors in this suite

Other tools by accurate_pouch for security + site health:

SSL Monitor — Certificate chain, expiry, fingerprint, key size, webhook. $0.004/domain.
DNS/WHOIS Suite — Full DNS lookup + RDAP. $0.004/domain.
Lighthouse Auditor — PageSpeed Insights API, Core Web Vitals, deltas, competitor comparison. $0.005/audit.
Tech Stack Detector — 7,517 signatures across 105 categories. $0.02/URL.
TheCrawler — Web scraper + LLM-powered structured extraction. AGPL-3.0, also on npm (thecrawler@0.1.1). $0.005/page.

Run on Apify

👁 Run on Apify

No setup needed. Click above to run in the cloud. $0.003 per operation.

HTTP Security Headers Audit

mbeato/apimesh-security-headers

Audit 10 HTTP security headers with A+ to F grading. Checks CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and more.

👁 User avatar

Maximus Beato

Security Headers Checker - Audit CSP, HSTS, XFO and more

scrappy_garden/security-headers-checker

Check common HTTP security headers for one or more URLs (Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP). Useful for quick security hardening audits.

👁 User avatar

Bikram Adhikari

Security Headers Checker API - HTTP Security Scanner

pink_comic/security-headers-checker

Security Headers Checker API for bulk HTTP security scans. Audit HSTS, CSP, X-Frame-Options, referrer and permissions policies, missing headers, website hardening gaps, and compliance posture. Returns grades, findings, and header evidence for security audits.

👁 User avatar

Ava Torres

HTTP Security Headers Analyzer

andok/security-headers-analyzer

Audit HTTP response headers (CSP, HSTS, X-Frame-Options) to verify web application security and compliance standards.

👁 User avatar

Andok

👁 🛡️ Security Headers Checker avatar

🛡️ Security Headers Checker

taroyamada/security-headers-checker

Audit HTTP security headers in bulk across hundreds of websites. Extract OWASP compliance grades and detect missing HSTS or CSP directives instantly.

👁 User avatar

naoki anzai

👁 Security Headers Checker avatar

Security Headers Checker

pillowy_travel/security-headers-checker

Analyze HTTP security headers of websites and generate a security score. Detect missing headers like CSP, HSTS, X-Frame-Options, and more. Perfect for web security audits, vulnerability checks, learning, and automated monitoring.

👁 User avatar

SAHIL KUMAR

👁 HTTP Probe -- TLS, Security Headers, Redirects avatar

HTTP Probe -- TLS, Security Headers, Redirects

jungle_synthesizer/ssl-security-headers-checker

Bulk site-health probe: TLS certificate, security-header grading (CSP, HSTS, X-Frame-Options, Permissions-Policy + 5 others, A/B/C/D/F grade), redirect chain, TTFB, HTTP/2 + HTTP/3, IPv6 reachability. Built for devops, security, and CI pipelines.

👁 User avatar

BowTiedRaccoon

👁 Http Header Inspector avatar

Http Header Inspector

zerobreak/http-header-inspector

HTTP header inspector that pulls response headers from any URL, scores them for security gaps, and flags missing CSP, HSTS, and X-Frame-Options, so teams can audit caching, redirects, and server config without running curl.

👁 User avatar

ZeroBreak

👁 Website Security & Vulnerability Audit avatar

Website Security & Vulnerability Audit

smart-digital/website-security-vulnerability-audit

Automated security and vulnerability audit for websites. Detects WordPress plugin vulnerabilities, checks for updates, analyzes SSL/TLS, security headers, and CMS security

My Smart Digital

5.0

Public Security Headers & Cookie Surface Audit Agent

jacksu/public-security-headers-audit-agent

Audit public HTTP response security headers, HTTPS redirect behavior, and cookie attribute exposure without scanning, attacking, or storing cookie values.

👁 User avatar

jack su

👁 Blog article image

How to send HTTP headers with cURL

👁 Blog article image

HTTP headers with Axios: a comprehensive guide

URL: https://apify.com/accurate_pouch/security-headers

⇱ Security Headers Checker — OWASP Audit & Grading · Apify

Security Headers Checker — OWASP Audit & Grading

What it checks

Grading

Quick start

Input

Output

Pricing

Related actors in this suite

Run on Apify

You might also like

HTTP Security Headers Audit

Security Headers Checker - Audit CSP, HSTS, XFO and more

Security Headers Checker API - HTTP Security Scanner

HTTP Security Headers Analyzer

🛡️ Security Headers Checker

Security Headers Checker

HTTP Probe -- TLS, Security Headers, Redirects

Http Header Inspector

Website Security & Vulnerability Audit

Public Security Headers & Cookie Surface Audit Agent

Related articles